PatchTheCVErocketsoftware vulnerabilities
Recent CVEs affecting rocketsoftware products. 7 tracked.
rocketsoftware has 7 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 6. Most recent: 2026-02-17. Highest priority: CVE-2025-27224 (score 62/100).
- CVE-2024-45955 HIGH 7.3 DOWNGRADE Rocket Software Rocket Zena 4.4.1.26 is vulnerable to SQL Injection via the filter parameter.
- CVE-2025-59793 CRITICAL 9.9 UPGRADE Rocket TRUfusion Enterprise through 7.10.5 exposes the endpoint at /axis2/services/WsPortalV6UpDwAxis2Impl to
- CVE-2025-32355 HIGH 7.3 UPGRADE Rocket TRUfusion Enterprise through 7.10.4.0 uses a reverse proxy to handle incoming connections
- CVE-2025-27225 HIGH 7.5 UPGRADE TRUfusion Enterprise through 7.10.4.0 exposes the /trufusionPortal/jsp/internal_admin_contact_login.jsp endpoi
- CVE-2025-27224 CRITICAL 9.8 UPGRADE TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/fileupload endpoint to upload files
- CVE-2025-27223 HIGH 7.5 UPGRADE TRUfusion Enterprise through 7.10.4.0 exposes the encrypted COOKIEID as an authentication mechanism for some e
- CVE-2025-27222 HIGH 8.6 UPGRADE TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/getCobrandingData endpoint to retrieve files
FAQ
How do I fix rocketsoftware vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is rocketsoftware being exploited right now?
None of the tracked rocketsoftware CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which rocketsoftware CVE should I patch first?
CVE-2025-27224 currently ranks highest (62/100): TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/fileupload endpoint to upload files.