CVE-2025-7958CWE-94code-injection

CVE-2025-7958

published June 26, 2026

CVSS

7.1

EPSS

Percentile

22.5

In the wild

Unconfirmed

What it is

A Code Injection vulnerability existed in Trellix Network Security CM and NX. A locally authenticated admin user can execute arbitrary code using the web interface and Alert artifact details.

The record

Technical detail

CVSS: 7.1 · NONE
CVSS v4.0: Not supplied
EPSS: 0.00309 · 22.5th percentile
Weakness: CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published: 2026-06-26T15:16Z

References (1)

https://support.trellix.com/s/article/000015433 · [email protected]

EPSS history

Timeline

26 JUN 10:15Z
A Code Injection vulnerability existed in Trellix Network Security CM and NX
cvelistv5