Read the docs

StrongDM

Records5All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9

Exploited now

StrongDM records in CISA KEV

No StrongDM vulnerabilities are listed in CISA KEV.

Records

5 records

TI-2025-05590 CVE-2025-6181 · GHSA-xvhc-jj62-7h84

OS command injection in StrongDM sdm-cli

Priority LOW 38

The StrongDM Windows service incorrectly handled input validation.

CVSS 4.0HIGH 8.5 Local Low privileges No interaction EPSS 0.00154 Published 2025-08-20 No fix listed CWE-78
TI-2025-05591 CVE-2025-6182 · GHSA-725m-6gv3-xj6r

Root Certificate Injection

Priority LOW 37

The StrongDM Windows service incorrectly handled communication related to system certificate management.

CVSS 4.0HIGH 8.5 Local Low privileges No interaction EPSS 0.00082 Published 2025-08-20 No fix listed CWE-269
TI-2025-05589 CVE-2025-6180 · GHSA-54jv-mpgv-wvp2

Authentication Hijack

Priority LOW 36

The StrongDM Client insufficiently protected a pre-authentication token.

CVSS 4.0HIGH 8.5 Local No auth User interaction EPSS 0.00111 Published 2025-08-20 No fix listed CWE-319
TI-2025-05592 CVE-2025-6183 · GHSA-w26h-fg7x-q5wc

Configd Injection

Priority LOW 30

The StrongDM macOS client incorrectly processed JSON-formatted messages.

CVSS 4.0HIGH 7.0 Local No auth No interaction EPSS 0.00162 Published 2025-08-20 No fix listed CWE-78
TI-2026-03815 CVE-2026-4387 · GHSA-qgjm-4mg2-6wm5

Unencrypted storage of authentication state in StrongDM Desktop Application state.kv file

Priority LOW 10

StrongDM Desktop Application before 23.74.0 (Desktop Client before 53.77.0) on Microsoft Windows stores authentication state, including a JSON Web Token and asymmetric key material, in cleartext in a per-user state file…

CVSS 4.0LOW 2.0 Local Low privileges No interaction EPSS 0.00132 Published 2026-05-29 Fixed in 23.74.0, 53.77.0 CWE-312
Open these records in search →