How severe is CVE-2025-9999?

CVE-2025-9999 has a CVSS 4.0 base score of 7.6, rated high severity.

Is CVE-2025-9999 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (5th percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2025-9999?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

Does CVE-2025-9999 have an EU (EUVD) identifier?

Yes. CVE-2025-9999 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-27012.

When was CVE-2025-9999 published?

CVE-2025-9999 was published on 2025-09-05 and last updated on 2026-06-17.

CVE-2025-9999

CVE-2025-9999 is a high-severity vulnerability with a CVSS 4.0 base score of 7.6. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-940.

Key facts

Severity: High (CVSS 4.0 base score 7.6)
EPSS exploit prediction: 0% (5th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-27012
Weakness: CWE-940
Published: 2025-09-05
Last modified: 2026-06-17

Description

Some payload elements of the messages sent between two stations in a networking architecture are not properly checked on the receiving station allowing an attacker to execute unauthorized commands in the application.

Frequently asked questions

What is CVE-2025-9999?: Some payload elements of the messages sent between two stations in a networking architecture are not properly checked on the receiving station allowing an attacker to execute unauthorized commands in the application.
How severe is CVE-2025-9999?: CVE-2025-9999 has a CVSS 4.0 base score of 7.6, rated high severity.
Is CVE-2025-9999 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (5th percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2025-9999?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2025-9999 have an EU (EUVD) identifier?: Yes. CVE-2025-9999 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-27012.
When was CVE-2025-9999 published?: CVE-2025-9999 was published on 2025-09-05 and last updated on 2026-06-17.

References

https://www.pcvue.com/security/#SB2025-4

Other CWE-940 vulnerabilities

CVE-2025-61932 — Critical (CVSS 9.8): Lanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA)) improperly verifies the origin…
CVE-2024-38886 — Critical (CVSS 9.8): An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions,…
CVE-2024-40515 — Critical (CVSS 9.8): An issue in SHENZHEN TENDA TECHNOLOGY CO.,LTD Tenda AX2pro V16.03.29.48_cn allows a remote attacker to execute…
CVE-2023-41355 — Critical (CVSS 9.8): Chunghwa Telecom NOKIA G-040W-Q Firewall function has a vulnerability of input validation for ICMP redirect messages.…
CVE-2026-48745 — Critical (CVSS 9.3): Traccar Client is a GPS tracking mobile app for sending location updates to private servers using the open-source…
CVE-2026-33875 — Critical (CVSS 9.3): Gematik Authenticator securely authenticates users for login to digital health applications. Versions prior to 4.16.0…

Browse all CWE-940 vulnerabilities →