PT-2025-10645 · Nintex · Nintex Automation

Ianis Bernard · Published 2025-03-10 · Updated 2026-01-29 · CVE-2025-27926

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nintex Automation versions 5.6 through 5.7

Description The issue concerns configuration files in the K2 SmartForms Designer folder that contain passwords readable by unauthorized users.

Recommendations For Nintex Automation versions 5.6 through 5.7, update to version 5.8 or later to resolve the issue.

Fix

Incorrect Default Permissions

Insufficiently Protected Credentials

Weakness Enumeration

CWE-276

CWE-522

Related Identifiers

CVE-2025-27926

Affected Products

Nintex Automation

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-27926 · Security Note
• https://osv.dev/vulnerability/CVE-2025-27926 · Vendor Advisory
• https://help.nintex.com/en-US/platform/ReleaseNotes/K2Five.htm · Note
• https://twitter.com/CVEnew/status/1899231414849318921 · Twitter Post
• https://t.me/cvedetector/20003 · Telegram Post
• https://t.me/cveNotify/150319 · Telegram Post
• https://t.me/cvetracker/18860 · Telegram Post
• https://t.me/cvenotify/114134 · Telegram Post