CVE-2026-25614

HighRCE

Published: 03 February 2026

Published

03 February 2026

Modified

13 February 2026

KEV Added

—

Patch

—

CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0006 18.1th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-25614 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Phillipsdata Blesta. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 18.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-25614 is an object injection vulnerability (CWE-502), tracked as CORE-5680, affecting Blesta versions 3.x through 5.x prior to 5.13.3. This flaw enables attackers to inject malicious objects into the application's serialization process, potentially leading to arbitrary code execution or other severe impacts depending on the deserialized classes available in the environment.

Exploitation requires low privileges (PR:L), can be performed over the network (AV:N) without user interaction (UI:N), but demands high attack complexity (AC:H) with unchanged scope (S:U). A successful attack yields high impacts on confidentiality, integrity, and availability (C:I:A:H), as reflected in the CVSS v3.1 base score of 7.5. Low-privileged users, such as authenticated customers or staff with limited access, could leverage this to escalate privileges or compromise the hosting environment.

Mitigation involves upgrading to Blesta 5.13.3 or later, as indicated by the vulnerability's versioning scope. Additional details are available in the official Blesta security advisory at https://www.blesta.com/2026/01/28/security-advisory/ and the Full Disclosure mailing list post at http://seclists.org/fulldisclosure/2026/Feb/2.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-5170

Vulnerability details

Blesta 3.x through 5.x before 5.13.3 allows object injection, aka CORE-5680.

CWE(s): CWE-502

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

T1059 Command and Scripting Interpreter Execution

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.

attack.mitre.org →

Why these techniques?

Object injection (deserialization) vuln in public-facing Blesta app directly enables remote exploitation by low-priv users leading to RCE/priv esc, mapping to T1190 for initial access, T1068 for escalation, and T1059 for resulting code execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1