How severe is CVE-2025-14600?

CVE-2025-14600 has a CVSS 4.0 base score of 9.3, rated critical severity.

Is CVE-2025-14600 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (31st percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2025-14600?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2025-14600 published?

CVE-2025-14600 was published on 2026-08-19.

CVE-2025-14600

CVE-2025-14600 is a critical-severity vulnerability with a CVSS 4.0 base score of 9.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-305.

Key facts

Severity: Critical (CVSS 4.0 base score 9.3)
EPSS exploit prediction: 0% (31st percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-305
Published: 2026-08-19
Last modified: 2026-08-19

Description

An insecure deserialization vulnerability in vsDesk allows a remote attacker to gain unauthorized administrative access. By manipulating application configuration data, an attacker can force the system to authenticate against an arbitrary LDAP server and provision a new administrative account. Apply patch from vendor https://vsdesk.ru/ . Versions 14.0402 and on have the patch.

Frequently asked questions

What is CVE-2025-14600?: An insecure deserialization vulnerability in vsDesk allows a remote attacker to gain unauthorized administrative access. By manipulating application configuration data, an attacker can force the system to authenticate against an arbitrary LDAP server and provision a new administrative account. Apply patch from vendor https://vsdesk.ru/ . Versions 14.0402 and on have the patch.
How severe is CVE-2025-14600?: CVE-2025-14600 has a CVSS 4.0 base score of 9.3, rated critical severity.
Is CVE-2025-14600 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (31st percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2025-14600?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
When was CVE-2025-14600 published?: CVE-2025-14600 was published on 2026-08-19.

References

Other CWE-305 vulnerabilities

CVE-2025-4320 — Critical (CVSS 10.0): Authentication Bypass by Primary Weakness, Weak Password Recovery Mechanism for Forgotten Password vulnerability in…
CVE-2025-24522 — Critical (CVSS 10.0): KUNBUS Revolution Pi OS Bookworm 01/2025 is vulnerable because authentication is not configured by default for the…
CVE-2024-36388 — Critical (CVSS 10.0): MileSight DeviceHub - CWE-305 Missing Authentication for Critical Function
CVE-2024-1403 — Critical (CVSS 10.0): In OpenEdge Authentication Gateway and AdminServer prior to 11.7.19, 12.2.14, 12.8.1 on all platforms supported by the…
CVE-2026-19349 — Critical (CVSS 9.8): Lemonldap::NG::Portal versions from 2.0.0 before 2.16.9, from 2.17.0 before 2.21.5, from 2.22.0 before 2.23.3 for Perl…
CVE-2026-25555 — Critical (CVSS 9.8): OpenBullet2 through version 0.3.2 contains an authentication bypass vulnerability in the API key authentication…

Browse all CWE-305 vulnerabilities →