How severe is CVE-2025-2244?

CVE-2025-2244 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2025-2244 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (60th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-2244?

CVE-2025-2244 affects Bitdefender Gravityzone. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2025-2244?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

Does CVE-2025-2244 have an EU (EUVD) identifier?

Yes. CVE-2025-2244 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-9722.

When was CVE-2025-2244 published?

CVE-2025-2244 was published on 2025-04-04 and last updated on 2026-06-17.

CVE-2025-2244

CVE-2025-2244 is a critical-severity vulnerability in Bitdefender Gravityzone with a CVSS 3.x base score of 9.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-502.

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
CVSS v4: 9.5
EPSS exploit prediction: 1% (60th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-9722
Weakness: CWE-502
Affected product: Bitdefender Gravityzone
Published: 2025-04-04
Last modified: 2026-06-17

Description

A vulnerability in the sendMailFromRemoteSource method in Emails.php as used in Bitdefender GravityZone Console unsafely uses php unserialize() on user-supplied input without validation. By crafting a malicious serialized payload, an attacker can trigger PHP object injection, perform a file write, and gain arbitrary command execution on the host system.

Frequently asked questions

What is CVE-2025-2244?: A vulnerability in the sendMailFromRemoteSource method in Emails.php as used in Bitdefender GravityZone Console unsafely uses php unserialize() on user-supplied input without validation. By crafting a malicious serialized payload, an attacker can trigger PHP object injection, perform a file write, and gain arbitrary command execution on the host system.
How severe is CVE-2025-2244?: CVE-2025-2244 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2025-2244 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (60th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-2244?: CVE-2025-2244 affects Bitdefender Gravityzone. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-2244?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
Does CVE-2025-2244 have an EU (EUVD) identifier?: Yes. CVE-2025-2244 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-9722.
When was CVE-2025-2244 published?: CVE-2025-2244 was published on 2025-04-04 and last updated on 2026-06-17.

References

http://bitdefender.com/support/security-advisories/insecure-php-deserialization-issue-in-gravityzone-console-va-12634

Affected products (1)

cpe:2.3:a:bitdefender:gravityzone:*:*:*:*:*:*:*:*

More vulnerabilities in Bitdefender Gravityzone

CVE-2024-6980 — Critical (CVSS 9.8): A verbose error handling issue in the proxy service implemented in the GravityZone Update Server allows an attacker to…
CVE-2017-8931 — Critical (CVSS 9.8): Bitdefender GravityZone VMware appliance before 6.2.1-35 might allow attackers to gain access with root privileges via…
CVE-2018-8955 — Critical (CVSS 9.8): The installer for BitDefender GravityZone relies on an encoded string in a filename to determine the URL for…
CVE-2021-3554 — Critical (CVSS 9.0): Improper Access Control vulnerability in the patchesUpdate API as implemented in Bitdefender Endpoint Security Tools…
CVE-2022-2830 — High (CVSS 8.8): Deserialization of Untrusted Data vulnerability in the message processing component of Bitdefender GravityZone Console…
CVE-2024-4177 — High (CVSS 8.1): A host whitelist parser issue in the proxy service implemented in the GravityZone Update Server allows an attacker to…

All CVEs affecting Bitdefender Gravityzone →

Other CWE-502 (Deserialization of Untrusted Data) vulnerabilities

CVE-2026-41104 — Critical (CVSS 10.0): Deserialization of untrusted data in Microsoft Planetary Computer Pro allows an unauthorized attacker to disclose…
CVE-2026-43633 — Critical (CVSS 10.0): HestiaCP versions 1.9.0 through 1.9.4 contain a deserialization vulnerability in the web terminal component caused by a…
CVE-2026-33819 — Critical (CVSS 10.0): Deserialization of untrusted data in Microsoft Bing allows an unauthorized attacker to execute code over a network.
CVE-2026-20131 — Critical (CVSS 10.0): A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could…
CVE-2026-25632 — Critical (CVSS 10.0): EPyT-Flow is a Python package designed for the easy generation of hydraulic and water quality scenario data of water…
CVE-2025-14931 — Critical (CVSS 10.0): Hugging Face smolagents Remote Python Executor Deserialization of Untrusted Data Remote Code Execution Vulnerability.…

Browse all CWE-502 (Deserialization of Untrusted Data) vulnerabilities →