Which versions of vsDesk are affected by CVE-2025-14600?

vsDesk, a help-desk platform used for IT service management, contains a critical unauthenticated remote vulnerability (CVSS 9.3) that allows attackers to create administrative accounts and assume…

How to fix or mitigate CVE-2025-14600?

Within 24 hours, identify all vsDesk deployments in your environment and assess criticality; implement emergency network containment by restricting administrative interface access to trusted internal IP ranges only and disabling LDAP directory service integration if not operationally required. Within 7 days, enable comprehensive monitoring and auditing of all administrative account creation, modification, and authentication events; conduct forensic analysis of authentication logs dating back to CVE-2025-14600 public disclosure to detect any unauthorized admin provisioning or exploitation indicators. Within 30 days, establish continuous monitoring of vsDesk vendor advisories and security channels for patch availability; if patch is released, apply it immediately to all affected instances; if no patch timeline emerges, develop and execute a business case for alternative help-desk solutions or migration planning.

vsDesk CVE-2025-14600

Q: What is the CVSS score of CVE-2025-14600?

CVE-2025-14600 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

EUVD-2025-210742 CRITICAL

Authentication Bypass by Primary Weakness (CWE-305)

2026-08-19 Kaspersky

GHSA-r87r-w586-7rg3

Deserialization Vsdesk

9.3

CVSS 4.0 · Vendor: Kaspersky

Severity by source

Vendor (Kaspersky) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated, low-complexity network request redirects LDAP auth to provision an admin account, yielding full C/I/A impact; no scope change beyond the application itself.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Kaspersky).

CVSS VectorVendor: Kaspersky

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 19, 2026 - 18:31 vuln.today

CVE Published

Aug 19, 2026 - 17:39 cve.org

CRITICAL 9.3

DescriptionCVE.org

An insecure deserialization vulnerability in vsDesk allows a remote attacker to gain unauthorized administrative access. By manipulating application configuration data, an attacker can force the system to authenticate against an arbitrary LDAP server and provision a new administrative account.

Apply patch from vendor https://vsdesk.ru/ . Versions 14.0402 and on have the patch.

AnalysisAI

Unauthenticated administrative account takeover in vsDesk (a Russian-market IT service-desk/help-desk platform) lets a remote attacker abuse insecure deserialization of application configuration data to point the login flow at an attacker-controlled LDAP server and provision a new admin account. Rated CVSS 4.0 9.3 (critical) with an unauthenticated network vector, it was researched and disclosed by Kaspersky (klsecservices); a detailed public write-up exists (KLSA-00296), though no CISA KEV listing or confirmed weaponized exploit is present in the data, so this is best characterized as no public exploit code identified at time of analysis despite a thorough advisory.

Technical ContextAI

vsDesk is a web-based help-desk / service-desk application. The root cause is classified as CWE-305 (Authentication Bypass by Primary Weakness): the primary authentication mechanism can be circumvented rather than defeated. Here the mechanism is external LDAP-based authentication whose target server and binding parameters are read from application configuration data that is deserialized without adequate integrity or trust controls. Because an attacker can influence that serialized configuration, they redirect authentication to an LDAP directory they control and have vsDesk accept and provision the resulting identity as an administrator. Notably, the Kaspersky advisory filename references a Path Traversal primitive ('Admin-Account-Takeover-via-Path-Traversal'), suggesting the config-manipulation/deserialization is reached or delivered via a path-traversal file access - a nuance not captured by the CWE-305 tag alone. Affected CPE is cpe:2.3:a:vsdesk:vsdesk:*:*:*:*:*:*:*:* (all versions prior to the fix).

RemediationAI

Vendor-released patch: vsDesk 14.0402 - upgrade to 14.0402 or later per the vendor release notes at https://vsdesk.ru/news/vyshla-novaya-versiya-140422 and the vendor site https://vsdesk.ru/. Until the upgrade is applied, reduce exposure by restricting network reachability of the vsDesk web interface to trusted management networks or VPN (removing direct internet exposure blocks the unauthenticated network vector but breaks remote self-service access for external users); where LDAP authentication is not required, disabling external LDAP integration removes the abused authentication redirection at the cost of directory-based single sign-on; and enforce egress filtering so the vsDesk server cannot initiate outbound LDAP (389/636) connections to arbitrary external hosts, which blocks binding to an attacker-controlled directory but must be scoped to preserve connectivity to legitimate internal LDAP servers. Also review administrator accounts for unexpected recently-created entries and monitor for anomalous LDAP configuration changes. Consult the Kaspersky advisory (KLSA-00296) for indicators.