CVE-2025-35114
Agiloft local privilege escalation via default credentials
- State
- Published
- Severity
- 8.7 High
- Published
- Aug 26, 2025
- Updated
- Aug 29, 2025
- Reserved
- Apr 15, 2025
Description
Agiloft Release 28 contains several accounts with default credentials that could allow local privilege escalation. The password hash is known for at least one of the accounts and the credentials could be cracked offline. Users should upgrade to Agiloft Release 30.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | cisa-cg |
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | cisa-cg |
Weaknesses
- CWE-1392 Use of Default Credentials
Affected Products
| Product | Versions |
|---|---|
AgiloftAgiloft |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.