Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-ctnu-wcs1-dfa2
Vulnerability ID VCID-ctnu-wcs1-dfa2
Aliases CVE-2025-5459
Summary A user with specific node group editing permissions and a specially crafted class parameter could be used to execute commands as root on the primary host. It affects Puppet Enterprise versions 2018.1.8 through 2023.8.3 and 2025.3 and has been resolved in versions 2023.8.4 and 2025.4.0.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
System Score Found at
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2025-5459
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2025-5459
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2025-5459
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2025-5459
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2025-5459
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2025-5459
epss 0.00097 https://api.first.org/data/v1/epss?cve=CVE-2025-5459
epss 0.00097 https://api.first.org/data/v1/epss?cve=CVE-2025-5459
epss 0.00097 https://api.first.org/data/v1/epss?cve=CVE-2025-5459
epss 0.00097 https://api.first.org/data/v1/epss?cve=CVE-2025-5459
epss 0.00097 https://api.first.org/data/v1/epss?cve=CVE-2025-5459
epss 0.00275 https://api.first.org/data/v1/epss?cve=CVE-2025-5459
epss 0.00275 https://api.first.org/data/v1/epss?cve=CVE-2025-5459
epss 0.00275 https://api.first.org/data/v1/epss?cve=CVE-2025-5459
cvssv4 8.6 https://portal.perforce.com/s/detail/a91PA000001SiDdYAK
ssvc Track https://portal.perforce.com/s/detail/a91PA000001SiDdYAK
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2025-5459
a91PA000001SiDdYAK https://portal.perforce.com/s/detail/a91PA000001SiDdYAK
No exploits are available.
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Found at https://portal.perforce.com/s/detail/a91PA000001SiDdYAK
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-06-26T13:30:51Z/ Found at https://portal.perforce.com/s/detail/a91PA000001SiDdYAK
Exploit Prediction Scoring System (EPSS)
Percentile 0.25565
EPSS Score 0.0009
Published At April 2, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-02T21:48:54.772634+00:00 EPSS Importer Import https://epss.cyentia.com/epss_scores-current.csv.gz 38.1.0