Critical severity · published Apr 14, 2026
CVE-2025-8095
Recoverable obfuscation using the OECH1 prefix encoding in OpenEdge
9.1
CVSS
0.2%
EPSS
No
On KEV
Description
The OECH1 prefix encoding is intended to obfuscate values across the OpenEdge platform. It has been identified as cryptographically weak and unsuitable for stored encodings and enterprise applications. OECH1 encodings should be considered exploitable and immediately replaced by any other supported prefix encoding, all of which are based on symmetric encryption.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 12% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
OpenEdge · Progress Software Corporation
12.2.0 through 12.2.18; 12.8.0 through 12.8.9 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-8095
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-8095
community.progress.com
https://community.progress.com/s/article/Unintended-Use-of-OECH1-for-Password-Secrets-Protection
More from OpenEdge
8.4
CVE-2025-7388
Authenticated Command Injection via configuration parameter manipulation in exposed RMI interface
8.2
CVE-2025-7389
Unauthorized Arbitrary File Read via RMI in AdminServer Interface