Vulnerability · Published Sep 22, 2025 · Assigned by cisa-cg
CVE-2025-35041Airship AI Acropolis MFA insufficient rate limiting
High 7.5
In plain English
A high-severity security flaw in Acropolis from Airship AI. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.3%top 73.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Airship AI Acropolis allows unlimited MFA attempts for 15 minutes after a user has logged in with valid credentials. A remote attacker with valid credentials could brute-force the 6-digit MFA code. Fixed in 10.2.35, 11.0.21, and 11.1.9.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Airship AI | Acropolis | 0 – before 10.2.350 – before 11.0.210 – before 11.1.9 |
Weakness: CWE-307 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H