PT-2026-25959 · Glpi+1 · Glpi+1

Login-Securite · Published 2026-03-17 · Updated 2026-04-17 · CVE-2026-25937

Positive Technologies (AI Summary)

CVSS v2.0

7.7

High

Base vector

AV:N/AC:L/Au:M/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions GLPI versions 11.0.0 through 11.0.5

Description GLPI is an Asset and IT management software package. A malicious actor with knowledge of a user's credentials can bypass Multi-Factor Authentication (MFA) and compromise the account. The issue affects versions starting from 11.0.0 up to, but not including, 11.0.6.

Recommendations Update to GLPI version 11.0.6 or later.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2026-07152

CVE-2026-25937

GHSA-2G3P-VWP2-7QXM

Affected Products

Glpi

Red Os

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25937.json · Exploit
• https://github.com/glpi-project/glpi/security/advisories/GHSA-2g3p-vwp2-7qxm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25937 · Security Note
• https://bdu.fstec.ru/vul/2026-07152 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-25937 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-25937 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-25937 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25937 · Vendor Advisory
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-glpi-cve-2026-25937-7.3 · Note
• https://redos.red-soft.ru/search/?iblock_id=24&q=CVE-2026-25937 · Note
• https://twitter.com/CVEarity/status/2034545673656504354 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2034204159268790360 · Twitter Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-glpi-cve-2026-25937-8.0 · Note
• https://twitter.com/CVEnew/status/2034136455845380494 · Twitter Post