CVE-2025-35114CWE-1392

Agiloft local privilege escalation via default credentials

High · published August 26, 2025

CVSS v4.0
8.7
EPSS
0%
Percentile
25.8
In the wild
Unconfirmed
What it is

Agiloft Release 28 contains several accounts with default credentials that could allow local privilege escalation. The password hash is known for at least one of the accounts and the credentials could be cracked offline. Users should upgrade to Agiloft Release 30.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00337 · 25.8th percentile
Weakness
CWE-1392 · Use of Default Credentials
Published
2025-08-26T22:18Z
EPSS history
Timeline
  • 26 AUG 22:18Z
    Agiloft local privilege escalation via default credentials
    cvelistv5