CVE-2025-11565
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause elevated system access when a Web Admin user on the local network tampers with the POST /REST/UpdateJRE request payload.
Risk Assessment
A Web Admin user on the local network could exploit the flaw to gain elevated system access.
Recommendation
Restrict Web Admin interface access to trusted networks and apply the vendor patch addressing path traversal in the POST /REST/UpdateJRE request.
Other vulnerabilities in Web Admin
See all- CVE-2026-2405Medium
CWE-400 Uncontrolled Resource Consumption vulnerability exists that could cause excessive troubleshooting zip file creation and denial of service when a Web Admin user floods the system with POST /helpabout requests.
- CVE-2026-2403Medium
A CWE-1284 (Improper Validation of Specified Quantity in Input) vulnerability allows a Web Admin user to alter the POST /logsettings request payload and cause Event and Data Log truncation, impacting log integrity.
- CVE-2026-2401Medium
CWE-532 insertion of sensitive information into a log file can expose confidential data when a Web Admin user executes a malicious file provided by an attacker.
Original NVD description (English source)
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause elevated system access when a Web Admin user on the local network tampers with the POST /REST/UpdateJRE request payload.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS