PatchTheCVEtrufusion enterprise vulnerabilities and fixes
Recent CVEs affecting trufusion enterprise, with upgrade or downgrade steps. 6 tracked.
Also searched as: trufusionenterprise.
trufusion enterprise has 6 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 6. Most recent: 2026-02-17. Highest priority: CVE-2025-27224 (score 62/100).
- CVE-2025-59793 CRITICAL 9.9 UPGRADE Rocket TRUfusion Enterprise through 7.10.5 exposes the endpoint at /axis2/services/WsPortalV6UpDwAxis2Impl to
- CVE-2025-32355 HIGH 7.3 UPGRADE Rocket TRUfusion Enterprise through 7.10.4.0 uses a reverse proxy to handle incoming connections
- CVE-2025-27225 HIGH 7.5 UPGRADE TRUfusion Enterprise through 7.10.4.0 exposes the /trufusionPortal/jsp/internal_admin_contact_login.jsp endpoi
- CVE-2025-27224 CRITICAL 9.8 UPGRADE TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/fileupload endpoint to upload files
- CVE-2025-27223 HIGH 7.5 UPGRADE TRUfusion Enterprise through 7.10.4.0 exposes the encrypted COOKIEID as an authentication mechanism for some e
- CVE-2025-27222 HIGH 8.6 UPGRADE TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/getCobrandingData endpoint to retrieve files
FAQ
How do I fix trufusion enterprise vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is trufusion enterprise being exploited right now?
None of the tracked trufusion enterprise CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which trufusion enterprise CVE should I patch first?
CVE-2025-27224 currently ranks highest (62/100): TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/fileupload endpoint to upload files.