CVE-2025-52099VulnerabilityPublished 24 Oct 2025Updated 3 Dec 2025

CVE-2025-52099

Source CVE Database V5

Not known to be exploited · CVSS 7.5 High.

Data as of 10 Dec 2025, 19:04 UTC

CVSS 3.1 base score

7.5High

How severe the flaw is on the 0–10 CVSS scale.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: None: There is no loss of confidentiality within the impacted component.
Integrity: None: There is no loss of integrity within the impacted component.
Availability: High: There is total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed). Alternatively, the attacker has the ability to deny some availability, but the loss of availability presents a direct, serious consequence to the impacted component (e.g., the attacker cannot disrupt existing connections, but can prevent new connections; the attacker can repeatedly exploit a vulnerability that, in each instance of a successful attack, leaks a only small amount of memory, but after repeated exploitation causes a service to become completely unavailable).

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 24 Oct 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

AI-suggested

Given the lack of specific affected products or patches, European organizations should implement network-level mitigations such as strict firewall rules to limit exposure of vulnerable services to untrusted networks. Deploy intrusion detection and prevention systems (IDS/IPS) with updated signatures to detect anomalous traffic patterns indicative of exploitation attempts. Employ rate limiting and traffic anomaly detection to mitigate denial of service attempts. Maintain robust network segmentation to isolate critical systems and reduce attack surface. Monitor system and network logs for signs of crashes or service disruptions that could indicate exploitation. Develop and test incident response plans focused on availability incidents. Engage with vendors and security communities to obtain updates on affected products and patches as they become available. Consider deploying redundancy and failover mechanisms to maintain service continuity in case of attacks. Regularly review and update network architecture to minimize exposure of critical services.

Impact

For European organizations, the primary impact of CVE-2025-52099 is operational disruption due to denial of service. Critical services exposed to the internet or internal networks could be rendered unavailable, affecting business continuity, customer service, and potentially safety-critical systems. Sectors such as finance, healthcare, telecommunications, and government services are particularly vulnerable due to their reliance on high availability and networked infrastructure. The disruption could lead to financial losses, reputational damage, and regulatory non-compliance, especially under GDPR mandates for service availability and incident response. The lack of confidentiality and integrity impact reduces risks related to data breaches but does not mitigate the operational risks. The absence of known exploits provides a window for proactive defense but also means organizations must remain vigilant for emerging attack campaigns. The vulnerability could be leveraged in coordinated attacks targeting European infrastructure or critical supply chains, amplifying its impact.

Summary

CVE-2025-52099 is a vulnerability published on October 24, 2025, with no specific affected versions or products disclosed. According to the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), the vulnerability is remotely exploitable over the network without any privileges or user interaction required. The attack complexity is low, meaning an attacker can easily exploit this flaw. The vulnerability does not affect confidentiality or integrity but results in a complete denial of service (availability impact is high). This suggests that an attacker can cause the targeted system or service to crash, hang, or become otherwise unavailable, disrupting normal operations. No known exploits in the wild or patches have been reported yet, indicating that the vulnerability might be newly disclosed or under analysis. The lack of specific affected software versions or products limits detailed technical analysis, but the network attack vector and high availability impact imply that critical network-facing services or infrastructure components could be targeted. The vulnerability’s scope is unchanged, meaning the impact is limited to the vulnerable component without affecting other system components or connected systems. The absence of required privileges and user interaction increases the risk profile, as exploitation can be automated and performed remotely by unauthenticated attackers.

Community reviews

Loading reviews…