CVE-2025-65118
Last modified
CVE-2025-65118 is a critical-severity vulnerability rated 9.3/10 on the CVSS scale. The vulnerability, if exploited, could allow an authenticated miscreant (OS Standard User) to trick Process Optimization services into loading arbitrary code and escalate privileges to OS System, potentially resulting in complete compromise of the Model Application Server.. EPSS estimates a 0.26% chance of exploitation in the next 30 days.
Description
The vulnerability, if exploited, could allow an authenticated miscreant (OS Standard User) to trick Process Optimization services into loading arbitrary code and escalate privileges to OS System, potentially resulting in complete compromise of the Model Application Server.
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Aveva | Process Optimization | < 2025 |
References
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-015-01Third Party Advisory, US Government Resource
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-65118?
How severe is CVE-2025-65118?
How do I fix CVE-2025-65118?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-65112PubNet is a self-hosted Dart & Flutter package service. Prio…9.8
- CVE-2025-65113ClipBucket v5 is an open source video sharing platform. Prio…6.5
- CVE-2025-65114Apache Traffic Server allows request smuggling if chunked me…7.5
- CVE-2025-65115Remote Code Execution Vulnerability in JP1/IT Desktop Manage…9.8
- CVE-2025-65116Buffer Overflow Vulnerability in JP1/IT Desktop Management 2…5.5
- CVE-2025-65117The vulnerability, if exploited, could allow an authenticate…7.7
- CVE-2025-65119An out-of-bounds read vulnerability exists in the EMF functi…7.1
- CVE-2025-6512On a client with a non-admin user, a script can be integrate…10
- CVE-2025-65120Reflected cross-site scripting vulnerability exists in Group…6.1
- CVE-2025-65122Regex Denial of Service in youtube-regex npm package through…7.5
- CVE-2025-65125SQL injection in gosaliajainam/online-movie-booking 5.5 in m…9.8
- CVE-2025-65127A lack of session validation in the web API component of She…6.5
Are you affected by CVE-2025-65118?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST