CVE-2025-35114highCWE-1392

CVE-2025-35114: high-severity vulnerability in Agiloft

Agiloft local privilege escalation via default credentials

Published · Updated

Follow this CVE+ Monitor Agiloft

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.7epss 0.4%
Agiloft Release 28 contains several accounts with default credentials that could allow local privilege escalation. The password hash is known for at least one of the accounts and the credentials could be cracked offline. Users should upgrade to Agiloft Release 30.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
Agiloft · Agiloft
Related CVEs — Agiloft

In the same product, most dangerous first.

CVE-2025-35113MEDIUMAgiloft improper neutralization in EUI template engineEPSS 0.4%CVE-2025-35112MEDIUMAgiloft XML external entity local path traversalEPSS 0.3%CVE-2025-35115CRITICALAgiloft insecure download of system packagesEPSS 0.2%