Cyber Resilience

CVE-2025-8095

Critical

Published: 14 April 2026

Published
14 April 2026
Modified
17 April 2026
KEV Added
—
Patch
—
CVSS Score v4 9.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:D/RE:M/U:Red
EPSS Score 0.0022 11.8th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2025-8095 is a critical-severity Storing Passwords in a Recoverable Format (CWE-257) vulnerability in Progress (inferred from references). Its CVSS base score is 9.1 (Critical).

Operationally, ranked at the 11.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

The OECH1 prefix encoding is intended to obfuscate values across the OpenEdge platform. It has been identified as cryptographically weak and unsuitable for stored encodings and enterprise applications. OECH1 encodings should be considered exploitable and immediately replaced by any other…

more

supported prefix encoding, all of which are based on symmetric encryption.

CWE(s)
CWE-257

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

Progress
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References