This vulnerability (CVE-2025-7389) in OpenEdge's AdminServer component allows authenticated users to leverage the AdminServer's elevated OS-level privileges to read arbitrary files on the host system. The issue stems from the setFile() and openFile() methods accessible through the RMI interface, which were improperly secured. These methods have been removed from the RMI interface to prevent exploitation. The vulnerability affects OpenEdge versions 12.2.0 and 12.8.0. The CVSS 4.0 score is 8.2, indicating high severity. No official patch or remediation guidance has been provided by the vendor as of the published date.

Authenticated users with access to the AdminServer component can exploit this vulnerability to gain OS-level access and read arbitrary files on the server hosting OpenEdge. This could lead to unauthorized disclosure of sensitive information and potential further compromise depending on the data accessed. The elevated privileges of the AdminServer process amplify the impact. No known active exploits have been reported.

The vulnerable methods (setFile() and openFile()) have been removed from the RMI interface, effectively eliminating this attack vector. However, no official patch or remediation level has been documented by the vendor. Users should verify that their OpenEdge installations do not expose these methods via RMI and monitor vendor advisories for any forthcoming official fixes or guidance. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.