Vulnerability · Published Aug 11, 2025 · Assigned by Omnissa
CVE-2025-25231
High 7.5
In plain English
A high-severity path traversal in Omnissa Workspace ONE UEM from Omnissa. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 25.1% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code.
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)25.1%top 2.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling2Nuclei, Public PoC
Official description
Omnissa Workspace ONE UEM contains a Secondary Context Path Traversal Vulnerability. A malicious actor may be able to gain access to sensitive information by sending crafted GET requests (read-only) to restricted API endpoints.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Omnissa | Omnissa Workspace ONE UEM | Omnissa Workspace ONE UEM version 24.10.0.10 or earlierOmnissa Workspace ONE UEM version 24.6.0.34 or earlierOmnissa Workspace ONE UEM version 24.2.0.29 or earlierOmnissa Workspace ONE UEM version 23.10.0.49 or earlier |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N