CVE-2025-59094
Local Privilege Escalation in dormakaba Kaba exos 9300 System management
- State
- Published
- Severity
- 8.4 High
- Published
- Jan 26, 2026
- Updated
- Jan 26, 2026
- Reserved
- Sep 9, 2025
Description
A local privilege escalation vulnerability has been identified in the Kaba exos 9300 System management application (d9sysdef.exe). Within this application it is possible to specify an arbitrary executable as well as the weekday and start time, when the specified executable should be run with SYSTEM privileges.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.4 High | CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | SEC-VLab |
Weaknesses
- CWE-269 Improper Privilege Management
Affected Products
| Product | Versions |
|---|---|
Kaba exos 9300dormakaba |
|
References
- https://r.sec-consult.com/dormakabatechnical-description
- https://r.sec-consult.com/dkexosthird-party-advisory
- https://www.dormakabagroup.com/en/security-advisoriesvendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.