Vulnerability · Published Jan 3, 2026 · Assigned by Dragos
CVE-2025-64125Nuvation Energy nCloud Client-to-Client Communication
Critical 9.4
In plain English
A critical-severity security flaw in nCloud VPN Service from Nuvation Energy. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).
Severity (CVSS 4.0)9.4Critical
Exploit odds (30 days)0.3%top 82.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A vulnerability in Nuvation Energy nCloud VPN Service allowed Network Boundary Bridging.This issue affected the nCloud VPN Service and was fixed on 2025-12-1 (December, 2025). End users do not have to take any action to mitigate the issue.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Nuvation Energy | nCloud VPN Service | 2025-12-1 |
Weakness: CWE-441 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:P