PatchTheCVECVE-2025-40738: A vulnerability has been identified in SINEC NMS (All versions < V4.0)
CVE-2025-40738 is a high-severity flaw (CVSS 8.8) affecting sinec nms. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A vulnerability has been identified in SINEC NMS (All versions < V4.0). The affected application does not properly validate file paths when extracting uploaded ZIP files. This could allow an attacker to write arbitrary files to restricted locations and potentially execute code with elevated privileges (ZDI-CAN-26572).
Why this priority
- High severity
- EPSS top 4%: very likely to be exploited
A fixed release or distro patch exists.
Risk facts
| CVSS score | 8.8 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 13.4% (top 4%) |
| CISA exploited list | No |
| Weakness | CWE-22 |
| Published | 2025-07-08 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2025-40738?
sinec nms: upgrade to 4.0. Exact commands for each OS are on this page.
Is CVE-2025-40738 being exploited?
CVE-2025-40738 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2025-40738 affect?
CVE-2025-40738 affects sinec nms. Severity is high (CVSS 8.8). A vulnerability has been identified in SINEC NMS (All versions < V4.0). The affected application does not properly validate file paths when extracting uploaded ZIP files. This could allow an attacker to write arbitrary files to restricted l
How urgent is CVE-2025-40738?
Priority 55/100. High severity; EPSS top 4%: very likely to be exploited
Software pages
Related CVEs
- CVE-2025-40755 HIGH 8.8 UPGRADE A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP1)
- CVE-2023-44487 HIGH 7.5 EXPLOITED MITIGATE UPGRADE HTTP/2 Rapid Reset Attack Vulnerability
- CVE-2026-25656 HIGH 7.8 MITIGATE UPGRADE A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP3), User Management Component (UMC) (A
- CVE-2026-25655 HIGH 7.8 UPGRADE A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP2)
- CVE-2025-40737 HIGH 8.8 UPGRADE A vulnerability has been identified in SINEC NMS (All versions < V4.0)