TI-2025-09387 Aliases CVE-2025-10226 GHSA-xfrw-g4q5-m2f8

PostgreSQL Upgrade from v10 to v17.4 in AxxonSoft Axxon One (C-Werk) 2.0.8 and earlier to…

MEDIUM 49CWE-1395Published 2025-09-10 · Updated 2025-10-08

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Dependency on Vulnerable Third-Party Component (CWE-1395) in the PostgreSQL backend in AxxonSoft Axxon One (C-Werk) 2.0.8 and earlier on Windows and Linux allows a remote attacker to escalate privileges, execute arbitrary code, or cause denial-of-service via exploitation of multiple known CVEs present in PostgreSQL v10.x, which are resolved in PostgreSQL 17.4.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00628 50th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
AxxonSoft	AxxonOne C-Werk	up to 2.0.8	—	No fix listed	CNA

AxxonOne C-Werk VendorAxxonSoft Affected up to 2.0.8 Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:axxonsoft:axxon_one::::::::	up to 2.0.8	Vulnerable	AxxonSoft
cpe:2.3:o:linux:linux_kernel:-:::::::*	not specified by NVD	Running on	Linux
cpe:2.3:o:microsoft:windows:-:::::::*	not specified by NVD	Running on	Microsoft

cpe:2.3:a:axxonsoft:axxon_one:*:*:*:*:*:*:*:* Versions up to 2.0.8 Vulnerable ·AxxonSoft
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Linux
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2025-10226
2026-10-03 Alias added: GHSA-xfrw-g4q5-m2f8
2026-10-29 EPSS moved to the 50th–90th percentile

References

Advisory 1

https://www.axxonsoft.com/legal/axxonsoft-vulnerability-disclosure-policy/security-advisories

Other 1

https://www.postgresql.org/docs/release

TI-2025-09381 Outdated Third-Party NuGet Packages in AxxonSoft Axxon One VMS 2.0.0 through 2.0.4 CVSS 4.0CRITICAL 9.3
TI-2025-09386 Incorrect Memory Allocation in OpenSSL-Based Session Module in AxxonSoft Axxon One (C-Werk) CVSS 4.0HIGH 8.7
TI-2025-09382 Hardcoded Password Exposure in AxxonNet (C-WerkNet) ARP Agent Logs CVSS 4.0MEDIUM 6.7
TI-2025-09385 Incorrect Evaluation of LDAP Nested Groups during Login in AxxonSoft Axxon One (C-Werk) CVSS 4.0MEDIUM 5.3
TI-2025-09384 Improper Session Cleanup on Role Removal in Web Admin Panel in AxxonSoft Axxon One (C-Werk) CVSS 4.0MEDIUM 5.3
TI-2025-09388 Lack of Encryption in Object Archive in AxxonSoft Axxon One (C-Werk) before 2.0.8 CVSS 4.0MEDIUM 5.1

See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences