CVE-2025-53867
Published: 17 July 2025
Summary
CVE-2025-53867 is a critical-severity Code Injection (CWE-94) vulnerability in Webbatch (inferred from references). Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 18.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-53867 is a remote code execution vulnerability affecting Island Lake WebBatch versions prior to 2025C. The flaw, tracked under CWE-94, permits an attacker to execute arbitrary code through a specially crafted URL and carries a CVSS 3.1 base score of 9.8, reflecting network attack vector, low complexity, and no required authentication or user interaction.
An unauthenticated remote attacker can supply a malicious URL to the vulnerable WebBatch instance and achieve full compromise of the confidentiality, integrity, and availability of the affected system. Because the attack requires no credentials or user assistance, it can be launched against any exposed installation reachable over the network.
Vendor references indicate that the issue is resolved in WebBatch 2025C, available from the official WinBatch version history page and discussed in the WinBatch forum thread. Administrators are advised to upgrade to 2025C or later to eliminate the exposure.
The associated EPSS score remains low at 0.0156 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-21782
Vulnerability details
Island Lake WebBatch before 2025C allows Remote Code Execution via a crafted URL.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct RCE via crafted URL on unauthenticated public-facing web application (CWE-94) maps to exploitation of public-facing apps.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Timely application of the vendor patch to Island Lake WebBatch 2025C directly remediates the RCE vulnerability exploited via crafted URLs.
Validating and sanitizing URL inputs prevents attackers from injecting malicious payloads that lead to arbitrary code execution.
Boundary protection mechanisms like web application firewalls monitor and block network traffic containing crafted malicious URLs targeting the vulnerable WebBatch instance.