CVE-2025-59783

HighRCE

Published: 04 March 2026

Published

04 March 2026

Modified

05 March 2026

KEV Added

—

Patch

—

CVSS Score 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0014 34.2th percentile

Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-59783 is a high-severity OS Command Injection (CWE-78) vulnerability in 2N Access Commander. Its CVSS base score is 7.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 34.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique.

Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SC-27 Platform-independent Applications

addresses: CWE-78

Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.

SI-10 Information Input Validation

addresses: CWE-78

Validates inputs to block special elements that would alter OS command execution.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1059 Command and Scripting Interpreter Execution

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.

attack.mitre.org →

Why these techniques?

OS command injection in network-accessible API endpoint directly enables remote arbitrary command execution (T1059) via public-facing application exploitation (T1190).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

API endpoint for user synchronization in 2N Access Commander version 3.4.1 did not have a sufficient input validation allowing for OS command injection. This vulnerability can only be exploited after authenticating with administrator privileges.

Deeper analysisAI

CVE-2025-59783 is an OS command injection vulnerability (CWE-78) affecting the API endpoint for user synchronization in 2N Access Commander version 3.4.1. The issue arises from insufficient input validation, which allows malicious input to be processed as operating system commands. Published on 2026-03-04, it has a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), indicating high severity with network accessibility and significant impacts on confidentiality, integrity, and availability.

Exploitation requires an attacker to first authenticate with administrator privileges on the affected system. Once authenticated, the attacker can inject and execute arbitrary OS commands remotely with low complexity and no user interaction required, potentially compromising the entire system.

The vendor has published an advisory with mitigation details, including a patch for 2N Access Commander version 3.5, available at https://www.2n.com/en-GB/download/cve_2025_59783_acom_3_5_v1pdf. Security practitioners should apply this update promptly to affected installations.