ibi WebFOCUS CVE-2025-11548

No special conditions stated - remote unauthenticated exploitation against network-reachable ibi WebFOCUS instances, with no authentication (PR:N) and no user interaction (UI:N) required per the vendor CVSS vector. The vendor advisory does not name a specific feature, protocol endpoint, or non-default configuration as a prerequisite, so default internet-facing or internally-exposed deployments appear exploitable. The primary limiting factor is network reachability of the WebFOCUS application: instances isolated behind VPN/segmentation or not exposed to untrusted networks substantially reduce exposure. Additionally, the advisory frames full RCE as a potential downstream outcome ('may lead to'), so the code-execution step may be contingent on version or configuration specifics not disclosed.

This is a genuine high-priority vulnerability, not a high-CVSS-but-low-risk artifact. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes the most dangerous profile possible: remote, network-reachable, low-complexity, no authentication, and no user interaction, with high confidentiality and integrity impact (VC:H/VI:H) plus low availability impact (VA:L). CWE-94 (code injection) combined with the described chain from unauthenticated privilege escalation to administrative access and then to unauthenticated RCE makes this attractive for both opportunistic and targeted attackers. The signals are not fully aligned, however: EPSS is only 0.52% (43rd percentile), which is modest and reflects that no public exploit or active exploitation has yet been observed rather than low exploitability - EPSS tends to lag for freshly disclosed enterprise flaws. The CVE is NOT on CISA KEV and there is no POC referenced, so despite the critical CVSS the real-world exploitation evidence is currently absent. No SSVC decision data was provided. Net assessment: treat as a priority patch due to the unauthenticated-RCE potential and trivial attack requirements, while recognizing that exploitation is presently theoretical and the description hedges with 'may lead to' RCE, meaning the full code-execution outcome may depend on configuration or additional steps not detailed in the advisory.

An attacker with network access to an internet-facing or internally-reachable ibi WebFOCUS instance sends crafted requests that abuse the privilege-escalation flaw to obtain administrative access to the application without any credentials or user interaction. From that administrative context the attacker leverages the platform's code-injection surface (CWE-94) to achieve remote code execution on the host. No public exploit code has been identified at time of analysis, so exploitation would currently require independent development.