PatchTheCVEautomation vulnerabilities and fixes
Recent CVEs affecting automation, with upgrade or downgrade steps. 4 tracked.
automation has 4 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 4. Most recent: 2025-03-10. Highest priority: CVE-2025-27925 (score 38/100).
- CVE-2025-27926 MEDIUM 4.3 UPGRADE In Nintex Automation 5.6 and 5.7 before 5.8, the K2 SmartForms Designer folder has configuration files (web.co
- CVE-2025-27925 HIGH 8.5 UPGRADE Nintex Automation 5.6 and 5.7 before 5.8 has insecure deserialization of user input.
- CVE-2025-27924 MEDIUM 5.4 UPGRADE Nintex Automation 5.6 and 5.7 before 5.8 has a stored XSS issue associated with the "Navigate to a URL" action
- CVE-2024-9845 HIGH 7.8 UPGRADE Under specific circumstances, insecure permissions in Ivanti Automation before version 2024.4.0.1 allows a loc
FAQ
How do I fix automation vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is automation being exploited right now?
None of the tracked automation CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which automation CVE should I patch first?
CVE-2025-27925 currently ranks highest (38/100): Nintex Automation 5.6 and 5.7 before 5.8 has insecure deserialization of user input..