BaseFortify

Publication date: 2025-11-12

Last updated on: 2025-11-12

Assigner: Omnissa

Description

Omnissa Workspace ONE UEM contains an observable response discrepancy vulnerability. A malicious actor may be able to enumerate sensitive information such as tenant ID and user accounts that could facilitate brute-force, password-spraying or credential-stuffing attacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-12

Last Modified

2025-11-12

Generated

2026-07-06

AI Q&A

2025-11-13

EPSS Evaluated

2026-07-05

NVD

CVE-2025-25236

EUVD

EUVD-2025-131962

Affected Vendors & Products

Vendor	Product	Version / Range
vmware	workspace_one_uem	3.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-204	The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.

Attack-Flow Graph

Executive Summary

This vulnerability in Omnissa Workspace ONE UEM is an observable response discrepancy that allows a malicious actor to enumerate sensitive information such as tenant IDs and user accounts. This information can then be used to facilitate attacks like brute-force, password-spraying, or credential-stuffing.

Impact Analysis

The vulnerability can lead to unauthorized access attempts by enabling attackers to gather sensitive information needed to perform brute-force, password-spraying, or credential-stuffing attacks, potentially compromising user accounts and tenant security.

Hi! I’m here to help you understand CVE-2025-25236. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70