High severity · published Sep 4, 2025
CVE-2025-7388
Authenticated Command Injection via configuration parameter manipulation in exposed RMI interface
8.4
CVSS
1%
EPSS
No
On KEV
Description
It was possible to perform Remote Command Execution (RCE) via Java
RMI interface in the OpenEdge AdminServer, allowing authenticated users to inject and
execute OS commands under the delegated authority of the AdminServer process. An RMI interface permitted manipulation of a configuration
property with inadequate input validation leading to OS command injection.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 61% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
OpenEdge · Progress Software Corporation
OpenEdge 12.2.0 before 12.2.18; OpenEdge 12.8.0 before 12.8.8 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-7388
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-7388
community.progress.com
https://community.progress.com/s/article/Important-RCE-Security-Update-for-OpenEdge-AdminServer
More from OpenEdge
9.1
CVE-2025-8095
Recoverable obfuscation using the OECH1 prefix encoding in OpenEdge
8.2
CVE-2025-7389
Unauthorized Arbitrary File Read via RMI in AdminServer Interface