CVE-2026-25615
Published: 03 February 2026
Summary
CVE-2026-25615 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Phillipsdata Blesta. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 17.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-25615 is an object injection vulnerability (CWE-502), tracked internally as CORE-5668, affecting Blesta versions 3.x through 5.x prior to 5.13.3. Published on 2026-02-03, it carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.
The vulnerability enables exploitation over the network with low complexity by attackers possessing high privileges, requiring no user interaction. Successful attacks can result in high confidentiality, integrity, and availability impacts on the affected system.
Advisories recommend upgrading to Blesta 5.13.3 or later to mitigate the issue, as versions before this release remain vulnerable. Further details are provided in the official Blesta security advisory at https://www.blesta.com/2026/01/28/security-advisory/ and the Full Disclosure mailing list posting at http://seclists.org/fulldisclosure/2026/Feb/1.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-5171
Vulnerability details
Blesta 3.x through 5.x before 5.13.3 allows object injection, aka CORE-5668.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Object injection (deserialization) in a publicly accessible web application (Blesta) directly enables remote exploitation of a public-facing service, matching T1190. High-privilege requirement and full C/I/A impact are consistent with post-auth RCE or equivalent server compromise via this vector.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely application of the vendor patch that upgrades Blesta to 5.13.3 and eliminates the object-injection flaw.
Enforces validation of all untrusted input before deserialization, blocking the CWE-502 object injection that CORE-5668 exploits.
Restricts the high-privilege accounts required for exploitation (PR:H), reducing the population that can reach the vulnerable deserialization code path.