High severity · published Jun 26, 2025
CVE-2025-5459
OS Command Injection
8.8
CVSS
1.1%
EPSS
No
On KEV
Description
A user with specific node group editing permissions and a specially crafted class parameter could be used to execute commands as root on the primary host. It affects Puppet Enterprise versions 2018.1.8 through 2023.8.3 and 2025.3 and has been resolved in versions 2023.8.4 and 2025.4.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PE
Puppet Enterprise · Perforce
2018.1.8 through 2023.8.3, 2025.3 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-5459
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-5459
Third Party Advisory
https://portal.perforce.com/s/detail/a91PA000001SiDdYAK
seclists.org
http://seclists.org/fulldisclosure/2026/Sep/9
More from Puppet Enterprise
6.9
CVE-2025-10360
Insufficiently Protected Credentials in Puppet Enterprise 2025.4 and 2025.5
6.7
CVE-2026-8804
Cleartext Storage of Sensitive Information for Puppet Resource API