CVE-2025-25236: Omnissa Workspace ONE UEM · Observable Discrepancy Response
Affects Omnissa Workspace ONE UEMSource CVE Database V5
Not known to be exploited · CVSS 5.3 Medium · fixed in 24.10.0.25 : update Omnissa Workspace ONE UEM when convenient.
Data as of 26 Oct 2026, 10:12 UTC
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 17% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 24.10.0.25, 24.6.0.44, 24.2.0.36
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 12 Nov 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade Omnissa Workspace ONE UEM to 24.10.0.25, 24.6.0.44 or 24.2.0.36.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Omnissa Omnissa Workspace ONE UEM | Affected
| Fixed in
|
AI-suggested
2) In the interim, restrict access to the Workspace ONE UEM management interfaces using network segmentation, VPNs, and IP whitelisting to reduce exposure to unauthenticated remote attackers. 3) Implement robust multi-factor authentication (MFA) for all user accounts to mitigate the risk of credential-based attacks facilitated by enumeration. 4) Enhance logging and monitoring to detect unusual authentication attempts, such as rapid login failures or password spraying patterns, and respond promptly. 5) Conduct regular user account audits to identify and disable inactive or unnecessary accounts, reducing the attack surface. 6) Educate users on strong password practices and consider deploying account lockout policies to limit brute-force attempts. 7) Employ web application firewalls (WAFs) or intrusion detection/prevention systems (IDS/IPS) configured to detect and block enumeration attempts based on anomalous request patterns. 8) Review and harden API endpoints and error handling mechanisms to minimize observable discrepancies that could leak information. These targeted measures go beyond generic advice by focusing on reducing the attack surface and detecting exploitation attempts specific to this vulnerability.
Description
Omnissa Workspace ONE UEM contains an observable response discrepancy vulnerability. A malicious actor may be able to enumerate sensitive information such as tenant ID and user accounts that could facilitate brute-force, password-spraying or credential-stuffing attacks.