PatchTheCVEagiloft vulnerabilities and fixes
Recent CVEs affecting agiloft, with upgrade or downgrade steps. 4 tracked.
agiloft has 4 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 4. Most recent: 2025-08-26. Highest priority: CVE-2025-35114 (score 38/100).
- CVE-2025-35115 HIGH 8.1 UPGRADE Agiloft Release 28 downloads critical system packages over an insecure HTTP connection
- CVE-2025-35114 HIGH 7.5 UPGRADE Agiloft Release 28 contains several accounts with default credentials that could allow local privilege escalat
- CVE-2025-35113 MEDIUM 5.9 UPGRADE Agiloft Release 28 does not properly neutralize special elements used in an EUI template engine, allowing an a
- CVE-2025-35112 MEDIUM 4.1 UPGRADE Agiloft Release 28 contains an XML External Entities vulnerability in any table that allows 'import/export', a
FAQ
How do I fix agiloft vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is agiloft being exploited right now?
None of the tracked agiloft CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which agiloft CVE should I patch first?
CVE-2025-35114 currently ranks highest (38/100): Agiloft Release 28 contains several accounts with default credentials that could allow local privilege escalat.