How severe is CVE-2025-2903?

CVE-2025-2903 has a CVSS 4.0 base score of 8.5, rated high severity.

Is CVE-2025-2903 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (8th percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2025-2903?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

Does CVE-2025-2903 have an EU (EUVD) identifier?

Yes. CVE-2025-2903 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-11512.

When was CVE-2025-2903 published?

CVE-2025-2903 was published on 2025-04-17 and last updated on 2026-06-17.

CVE-2025-2903

CVE-2025-2903 is a high-severity vulnerability with a CVSS 4.0 base score of 8.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-267.

Key facts

Severity: High (CVSS 4.0 base score 8.5)
EPSS exploit prediction: 0% (8th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-11512
Weakness: CWE-267
Published: 2025-04-17
Last modified: 2026-06-17

Description

An attacker with knowledge of creating user accounts during VM deployment on Google Cloud Platform (GCP) using the OS Login feature, can login via SSH gaining command-line control of the operating system. This allows an attacker to gain access to sensitive data stored on the VM, install malicious software, and disrupt or disable the functionality of the VM.

Frequently asked questions

What is CVE-2025-2903?: An attacker with knowledge of creating user accounts during VM deployment on Google Cloud Platform (GCP) using the OS Login feature, can login via SSH gaining command-line control of the operating system. This allows an attacker to gain access to sensitive data stored on the VM, install malicious software, and disrupt or disable the functionality of the VM.
How severe is CVE-2025-2903?: CVE-2025-2903 has a CVSS 4.0 base score of 8.5, rated high severity.
Is CVE-2025-2903 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (8th percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2025-2903?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2025-2903 have an EU (EUVD) identifier?: Yes. CVE-2025-2903 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-11512.
When was CVE-2025-2903 published?: CVE-2025-2903 was published on 2025-04-17 and last updated on 2026-06-17.

References

https://portal.perforce.com/s/detail/a91PA000001Sed3YAC

Other CWE-267 vulnerabilities

CVE-2023-22647 — Critical (CVSS 9.9): An Improper Privilege Management vulnerability in SUSE Rancher allowed standard users to leverage their existing…
CVE-2026-29646 — Critical (CVSS 9.8): In OpenXiangShan NEMU prior to 55295c4, when running with RVH (Hypervisor extension) enabled, a VS-mode guest write to…
CVE-2021-44547 — Critical (CVSS 9.1): A sandboxing issue in Odoo Community 15.0 and Odoo Enterprise 15.0 allows authenticated administrators to executed…
CVE-2026-27314 — High (CVSS 8.8): Privilege escalation in Apache Cassandra 5.0 on an mTLS environment using MutualTlsAuthenticator allows a user with…
CVE-2025-14349 — High (CVSS 8.8): Privilege Defined With Unsafe Actions, Missing Authentication for Critical Function vulnerability in Universal Software…
CVE-2026-0945 — High (CVSS 8.8): Privilege Defined With Unsafe Actions vulnerability in Drupal Role Delegation allows Privilege Escalation.This issue…

Browse all CWE-267 vulnerabilities →