Vulnerability · Published Apr 14, 2026 · Assigned by ProgressSoftware

CVE-2025-8095Recoverable obfuscation using the OECH1 prefix encoding in OpenEdge

Critical 9.1

In plain English

A critical-severity security flaw in OpenEdge from Progress Software Corporation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).

Severity (CVSS 4.0)9.1Critical

Exploit odds (30 days)0.2%top 87.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The OECH1 prefix encoding is intended to obfuscate values across the OpenEdge platform. It has been identified as cryptographically weak and unsuitable for stored encodings and enterprise applications. OECH1 encodings should be considered exploitable and immediately replaced by any other supported prefix encoding, all of which are based on symmetric encryption.

Affected products (as reported)

Vendor	Product	Versions
Progress Software Corporation	OpenEdge	12.2.0 – through 12.2.1812.8.0 – through 12.8.9

Weakness: CWE-257 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/AU:Y/V:D/RE:M/U:Red

References

https://community.progress.com/s/article/Unintended-Use-of-OECH1-for-Password-Secrets-Protection