CVE-2025-11955CWE-299

CVE-2025-11955

published October 27, 2025

CVSS
8.2
EPSS
0%
Percentile
10.8
In the wild
Unconfirmed
What it is

Incorrect validation of OCSP certificates vulnerability in TheGreenBow VPN, versions 7.5 and 7.6. During the IKEv2 authentication step, the OCSP-enabled VPN client establishes the tunnel even if it does not receive an OCSP response or if the OCSP response signature is invalid.

The record
Technical detail
CVSS
8.2 · NONE
CVSS v4.0
Not supplied
EPSS
0.00211 · 10.8th percentile
Weakness
CWE-299 · Improper Check for Certificate Revocation
Published
2025-10-27T16:15Z
References (2)
https://www.incibe.es/en/incibe-cert/notices/aviso/incorrect-validation-ocsp-certificates-thegreenbow-vpn-client-windows · [email protected]https://www.thegreenbow.com/en/support/security-alerts/ · [email protected]
EPSS history
Timeline
  • 27 OCT 11:30Z
    Incorrect validation of OCSP certificates in TheGreenBow VPN Client Windows Enterprise
    cvelistv5