CVE-2018-25320
ACL Analytics 11.x - 13.0.0.579 Arbitrary Code Execution
- State
- Published
- Severity
- 9.3 Critical
- Published
- May 17, 2026
- Updated
- Oct 1, 2026
- Reserved
- May 17, 2026
Description
ACL Analytics versions 11.x through 13.0.0.579 contain an arbitrary code execution vulnerability that allows attackers to execute arbitrary commands by leveraging the EXECUTE function. Attackers can use bitsadmin to download malicious PowerShell scripts and execute them with system privileges to establish reverse shells and gain complete system control.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected Products
| Product | Versions |
|---|---|
ACL Analyticsacl |
|
References
- ExploitDB-44281exploit
- Official Product Homepageproduct
- Product Referenceproduct
- VulnCheck Advisory: ACL Analytics 11.x - 13.0.0.579 Arbitrary Code Executionthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.