Authenticated Command Injection via configuration parameter manipulation in exposed RMI interface
Priority MEDIUM 40CWE-77Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-77.
Summary
It was possible to perform Remote Command Execution (RCE) via Java RMI interface in the OpenEdge AdminServer, allowing authenticated users to inject and execute OS commands under the delegated authority of the AdminServer process. An RMI interface permitted manipulation of a configuration property with inadequate input validation leading to OS command injection.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00958 61st percentileScored 2026-11-07
Fix Fixed OpenEdge (Progress Software Corporation): 12.2.18, 12.8.8
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Progress | OpenEdge | OpenEdge 12.2.0 to before 12.2.18; OpenEdge 12.8.0 to before 12.8.8 | 12.2.18, 12.8.8 | Patch available | CNA |
- OpenEdge VendorProgress Affected OpenEdge 12.2.0 to before 12.2.18; OpenEdge 12.8.0 to before 12.8.8 Fixed in 12.2.18, 12.8.8 Patch available CNA
Remediation
- Fix · CNA OpenEdge (Progress Software Corporation) Fixed in 12.2.18, 12.8.8
Timeline
- 2026-10-02 Threatist record created from CVE-2025-7388
- 2026-10-03 Alias added: GHSA-wgfx-894g-ff23
References
More Progress vulnerabilities
- TI-2026-07083 Command injection in Progress LoadMaster KEVCVSS 3.1CRITICAL 9.8
- TI-2024-06182 WhatsUp Gold HasErrors SQL Injection Authentication Bypass Vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2024-04541 WhatsUp Gold GetFileWithoutZip Directory Traversal Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2024-04060 Registration Authentication Bypass Vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2024-01127 LoadMaster Pre-Authenticated OS Command Injection KEVCVSS 3.1CRITICAL 10.0
- TI-2023-20934 WS_FTP Server Ad Hoc Transfer Module .NET Deserialization Vulnerability KEVCVSS 3.1CRITICAL 10.0
Sources
- CVE-2025-7388 · CVE Program
- CVE-2025-7388 · NVD
- FIRST EPSS
- GHSA-wgfx-894g-ff23 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences