CVE-2025-59093

Exos 9300 instances are using a randomly generated database password to connect to the configured MSSQL server. The password is derived from static random values, which are concatenated to the hostname and a random string that can be read by every user from the registry. This allows an attacker to derive the database password and get authenticated access to the central exos 9300 database as the user Exos9300Common. The user has the roles ExosDialog and ExosDialogDotNet assigned, which are able to read most tables of the database as well as update and insert into many tables.

• CWE-656

• https://r.sec-consult.com/dkexos
• https://r.sec-consult.com/dormakaba
• https://www.dormakabagroup.com/en/security-advisories

Published

Jan 26, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-59088If kdcproxy receives a request for a realm which does not ha…8.6
• CVE-2025-59089If an attacker causes kdcproxy to connect to an attacker-con…5.9
• CVE-2025-5909A vulnerability, which was classified as critical, was found…8.8
• CVE-2025-59090On the exos 9300 server, a SOAP API is reachable on port 800…9.3
• CVE-2025-59091Multiple hardcoded credentials have been identified, which a…9.3
• CVE-2025-59092An RPC service, which is part of exos 9300, is reachable on …8.7
• CVE-2025-59094A local privilege escalation vulnerability has been identifi…8.4
• CVE-2025-59095The program libraries (DLL) and binaries used by exos 9300 c…6.8
• CVE-2025-59096The default password for the extended admin user mode in the…4.6
• CVE-2025-59097The exos 9300 application can be used to configure Access Ma…9.3
• CVE-2025-59098The Access Manager is offering a trace functionality to debu…8.7
• CVE-2025-59099The Access Manager is using the open source web server Compa…8.8