Read the docs
TI-2025-24583 Aliases CVE-2025-35114GHSA-vw2q-8fmv-fj4f

Agiloft local privilege escalation via default credentials

Priority MEDIUM 46CWE-1392Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Agiloft Release 28 contains several accounts with default credentials that could allow local privilege escalation. The password hash is known for at least one of the accounts and the credentials could be cracked offline. Users should upgrade to Agiloft Release 30.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00351 28th percentileScored 2026-11-07
Fix Fixed Agiloft (Agiloft): Release 30

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AtlassianAgiloftbefore Release 30Release 30Patch availableCNA
  • Agiloft VendorAtlassian Affected before Release 30 Fixed in Release 30 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:atlassian:agiloft:*:*:*:*:*:*:*:*19 to before 30VulnerableAtlassian
  • cpe:2.3:a:atlassian:agiloft:*:*:*:*:*:*:*:* Versions 19 to before 30 Vulnerable ·Atlassian

Remediation

  • Fix · CNA Agiloft (Agiloft) Fixed in Release 30

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Agiloft Release 30

    2 records Highest priority Priority HIGH 1 HIGH, 1 MEDIUM

    Other records, highest priority first

    • TI-2025-24584 Agiloft insecure download of system packagesPriority HIGH 75
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-35114
  2. 2026-10-03 Alias added: GHSA-vw2q-8fmv-fj4f

References

Advisory 3

  • TI-2025-24584 Agiloft insecure download of system packages CVSS 4.0CRITICAL 9.2
  • TI-2025-24581 Agiloft XML external entity local path traversal CVSS 4.0MEDIUM 5.1
  • TI-2025-24582 Agiloft improper neutralization in EUI template engine CVSS 4.0MEDIUM 4.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences