CVE-2025-8352

Denial-of-service vulnerability in ESET PROTECT On-Prem

State: Published
Severity: 6.9 Medium
Published: Oct 6, 2026
Updated: Oct 6, 2026
Reserved: Jul 30, 2025

Description

Allocation of resources without limits or throttling vulnerability in ESET PROTECT On-Prem increased resource consumption (CPU and RAM), leading to conditions for a Denial-of-Service attack.

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N	ESET

Weaknesses

CWE-770 Allocation of resources without limits or throttling

Affected Products

Product	Versions
ESET PROTECT On-PremESET spol. s.r.o	12.1.9.0 (with Web Console 12.1.252.0) and earlierAffectedfrom 12.1.11.0 (using Web Console 12.1.260.0 on Apache Tomcat 9.0.107)Not affected 12.0.13.0 (with Web Console 12.0.289.0) and earlierAffectedfrom 12.0.15.0 (using Web Console 12.0.306.0 on Apache Tomcat 9.0.107)Not affected 11.1.16.0 (with Web Console 11.1.149.0) and earlierAffectedfrom 11.1.18.0 (using Web Console 11.1.159.0 on Apache Tomcat 9.0.107)Not affected

Product

Versions

ESET PROTECT On-PremESET spol. s.r.o

12.1.9.0 (with Web Console 12.1.252.0) and earlierAffectedfrom 12.1.11.0 (using Web Console 12.1.260.0 on Apache Tomcat 9.0.107)Not affected
12.0.13.0 (with Web Console 12.0.289.0) and earlierAffectedfrom 12.0.15.0 (using Web Console 12.0.306.0 on Apache Tomcat 9.0.107)Not affected
11.1.16.0 (with Web Console 11.1.149.0) and earlierAffectedfrom 11.1.18.0 (using Web Console 11.1.159.0 on Apache Tomcat 9.0.107)Not affected

References

https://support.eset.com/en/ca8854-eset-customer-advisory-denial-of-service-vulnerability-in-eset-protect-on-prem-fixed

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.