CVE-2025-7389

The record

A vulnerability in the AdminServer component of OpenEdge on all supported platforms grants its authenticated users OS-level access to the server through the adopted authority of the AdminServer process itself.  The delegated authority of the AdminServer could allow its users the ability to read arbitrary files on the host system through the misuse of the setFile() and openFile() methods exposed through the RMI interface.  Misuse was limited only by OS-level authority of the AdminServer's elevated privileges granted and the user's access to these methods enabled through RMI.  The exploitable methods have been removed thus eliminating their access through RMI or downstream of the RMI registry.

Affected packages

Related vulnerabilities

• CVE-2026-75164 An arbitrary file read vulnerability in /cgi-bin/ugwdownload.cgi of MBS-Solutions X-Serie… CWE-552
• CVE-2026-74853 The Pods WordPress plugin before 3.3.9.2 does not restrict which functions a display… CWE-552
• CVE-2026-67402 An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI… CWE-552
• CVE-2026-85175 SiYuan versions <= 3.8.1 (fixed in v3.8.2) contain an incomplete blocklist in the… CWE-552
• CVE-2026-73735 Vulnerabilities in the API of HPE Networking Fabric Composer could allow an authenticated… CWE-552
• CVE-2026-73736 A vulnerability in the web-based management interface of HPE Networking Fabric Composer… CWE-552
• CVE-2026-82020 Hermes Agent 0.16.0 prior to 0.17.0 contains an improper path restriction vulnerability… CWE-552
• CVE-2026-75889 Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can… CWE-552