PT-2025-35938 · Progress · Openedge Adminserver

Published 2025-09-04 · Updated 2025-09-04 · CVE-2025-7388

Positive Technologies · (AI Summary)

CVSS v3.1

8.4

8.4

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions:

OpenEdge AdminServer (affected versions not specified)

Description:

The software contains a Remote Command Execution (RCE) issue via the Java RMI interface. Authenticated users can inject and execute OS commands under the authority of the AdminServer process. Insufficient input validation of a configuration property within the RMI interface leads to OS command injection.

Recommendations:

At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2025-7388

Affected Products

Openedge Adminserver

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-7388 · Security Note
• https://community.progress.com/s/article/Important-RCE-Security-Update-for-OpenEdge-AdminServer · Note
• https://twitter.com/MCKSysAr/status/1963630825599078515 · Twitter Post
• https://twitter.com/_CoreImpact/status/1963674167905079783 · Twitter Post
• https://twitter.com/CVEnew/status/1963602769732083882 · Twitter Post