Cyber Resilience

CVE-2025-8589

HighUpdated

Published: 03 February 2026

Published
03 February 2026
Modified
05 June 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
EPSS Score 0.0002 5.6th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-8589 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Gov (inferred from references). Its CVSS base score is 7.6 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 5.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).

Deeper analysis

CVE-2025-8589 is an Improper Neutralization of Input During Web Page Generation vulnerability, specifically a Reflected Cross-Site Scripting (XSS) issue classified under CWE-79, affecting SKSPro software developed by AKCE Software Technology R&D Industry and Trade Inc. The vulnerability impacts all versions of SKSPro through 07012026. It has a CVSS v3.1 base score of 7.6, reflecting network accessibility, low attack complexity, no required privileges, user interaction dependency, unchanged scope, low confidentiality and integrity impacts, and high availability impact.

Remote attackers with no privileges can exploit this vulnerability over the network by crafting malicious input that is reflected back in web page generation, tricking users into interacting with it, such as clicking a malicious link or submitting tainted data. Successful exploitation enables execution of arbitrary scripts in the victim's browser context, potentially leading to limited data exposure or modification while causing significant denial-of-service effects due to the high availability impact.

For mitigation details, refer to the advisory published by the Turkish National Cyber Incident Response Center (USOM) at https://www.usom.gov.tr/bildirim/tr-26-0011, which notified stakeholders of the issue following its publication on 2026-02-03.

EU & UK References

Vulnerability details

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in AKCE Software Technology R&D Industry and Trade Inc. SKSPro allows Reflected XSS. This issue affects SKSPro: through 07012026.

CWE(s)
CWE-79

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1204.001 Malicious Link Execution
An adversary may rely upon a user clicking a malicious link in order to gain execution.
attack.mitre.org →
Why these techniques?

Reflected XSS in public-facing web app enables remote exploitation via crafted malicious links requiring user interaction/click.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-22765Shared CWE-79
CVE-2024-13885Shared CWE-79
CVE-2025-23645Shared CWE-79
CVE-2025-24017Shared CWE-79
CVE-2025-24544Shared CWE-79
CVE-2025-68037Shared CWE-79
CVE-2025-23725Shared CWE-79
CVE-2025-22357Shared CWE-79
CVE-2026-24955Shared CWE-79
CVE-2025-23834Shared CWE-79

Affected Assets

Gov
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-15 Information Output Filtering good match
prevent

Directly mitigates reflected XSS by filtering information outputs during web page generation to neutralize malicious scripts.

SI-10 Information Input Validation good match
prevent

Prevents exploitation by validating and sanitizing user inputs before they are reflected in web pages, addressing improper neutralization.

SI-2 Flaw Remediation good match
prevent

Remediates the specific XSS flaw through timely installation of software patches or updates for affected SKSPro versions.

References