This vulnerability (CVE-2025-9588) in Iron Mountain Archiving Services Inc. enVision is classified as CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'). It affects versions before 250563. The flaw allows unauthenticated remote attackers to inject and execute arbitrary OS commands, resulting in complete system compromise. The CVSS 3.1 base score is 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), reflecting high severity and ease of exploitation. No patch links or vendor advisories are currently available, and the product is not a cloud service.

Successful exploitation of this vulnerability can lead to full system compromise, including complete loss of confidentiality, integrity, and availability of the affected system. Attackers can execute arbitrary OS commands remotely without any authentication or user interaction, potentially leading to data theft, system disruption, or further network compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the affected enVision service and monitor for suspicious activity related to command injection attempts. Avoid exposing the vulnerable service to untrusted networks.