CVE-2025-47221: signserver · Improper Access Control
Affects signserverSource CVE Database V5
Not known to be exploited · CVSS 5.3 Medium : upgrade to 7.3.2 when convenient.
Data as of 26 Oct 2026, 10:12 UTC
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 18% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 7.3.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 13 Nov 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade com.keyfactor/signserver to 7.3.2.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
Mavencom.keyfactor/signserverpkg:maven/com.keyfactor/signserverOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
European organizations should immediately verify their Keyfactor SignServer version and upgrade to version 7.3.2 or later where this vulnerability is addressed. Until upgrading, restrict administrative access strictly to trusted personnel and implement multi-factor authentication to reduce the risk of credential compromise. Audit and monitor configuration changes to the ARCHIVETODISK_FILENAME-PATTERN, ARCHIVETODISK_PATH_BASE, and ARCHIVETODISK_PATH_PATTERN properties to detect unauthorized modifications. Employ file integrity monitoring on directories accessible by the JBoss user to detect unexpected file overwrites. Limit the permissions of the JBoss user to the minimum necessary to reduce the impact of potential overwrites. Additionally, conduct regular security training for administrators to prevent misuse of privileges. Network segmentation and strict firewall rules should be applied to limit access to the SignServer management interfaces. Finally, maintain up-to-date backups of critical files and configurations to enable recovery in case of compromise.
Description
An arbitrary file write was found in Keyfactor SignServer versions prior to 7.3.2. The properties ARCHIVETODISK_FILENAME-PATTERN, ARCHIVETODISK_PATH_BASE, ARCHIVETODISK_PATH_PATTERN can be set to any path, even ones that will point to files that already exist. This vulnerability gives a user with admin access the possibility to write files in arbitrary directories in the server file system and potentially overwrite files accessible by the local user JBoss.