CVE-2025-13506

High

Published: 12 December 2025

Published

12 December 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0008 23.5th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-13506 is a high-severity Execution with Unnecessary Privileges (CWE-250) vulnerability in Gov (inferred from references). Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 23.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-25 (Reference Monitor) and AC-3 (Access Enforcement).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

AC-6 Least Privilege good match

prevent

Directly addresses execution with unnecessary privileges by enforcing least privilege on database processes to prevent OS control escalation.

AC-3 Access Enforcement good match

prevent

Enforces access control policies that block low-privileged database access from expanding to full operating system privileges.

AC-25 Reference Monitor good match

prevent

Implements a tamper-proof reference monitor to mediate and restrict unauthorized access attempts from the database layer to OS resources.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

Why these techniques?

The vulnerability is explicitly an Execution with Unnecessary Privileges issue (CWE-250) allowing low-privileged network attackers to execute arbitrary code and escalate to full OS control from the database layer, directly mapping to Exploitation for Privilege Escalation.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

Execution with Unnecessary Privileges vulnerability in Nebim Neyir Computer Industry and Services Inc. Nebim V3 ERP allows Expanding Control over the Operating System from the Database.This issue affects Nebim V3 ERP: from 2.0.59 before 3.0.1.

Deeper analysisAI

CVE-2025-13506 is an Execution with Unnecessary Privileges vulnerability (CWE-250) in Nebim V3 ERP, a product of Nebim Neyir Computer Industry and Services Inc. The issue enables expanding control over the operating system from the database layer. It affects Nebim V3 ERP versions starting from 2.0.59 up to but not including 3.0.1, with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

The vulnerability can be exploited by an attacker with low privileges over the network, requiring low attack complexity and no user interaction. Successful exploitation allows the attacker to achieve high impacts across confidentiality, integrity, and availability, effectively granting unnecessary elevated privileges to execute arbitrary code and expand control from the database to the full operating system.

The advisory at https://www.usom.gov.tr/bildirim/tr-25-0450 provides further details on the issue. Mitigation requires upgrading to Nebim V3 ERP version 3.0.1 or later, as the vulnerability is fixed in that release.