What is the CVSS score of CVE-2025-22463?

CVE-2025-22463 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.2%.

Which versions of Workspace Control are affected by CVE-2025-22463?

Ivanti Workspace Control contains a hardcoded encryption key that allows authenticated local users to decrypt stored environment passwords, potentially exposing privileged credentials and enabling…

How to fix or mitigate CVE-2025-22463?

Within 24 hours: Identify all systems running Ivanti Workspace Control versions prior to 10.19.10.0 and assess exposure in high-value environments. Within 7 days: Implement network segmentation to restrict local access to affected systems, enforce strong access controls for local user accounts, and rotate all environment passwords managed through the application. Within 30 days: Establish a vendor contact plan for patch availability, evaluate alternative workspace control solutions, and implement enhanced monitoring for unauthorized credential access attempts.

Workspace Control CVE-2025-22463

EUVD-2025-17688 HIGH

Use of Hard-coded Cryptographic Key (CWE-321)

2025-06-10 3c1d8aa1-5a33-4ea4-8992-aadd6440af75

Information Disclosure Ivanti Privilege Escalation Workspace Control

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 19:49 euvd

EUVD-2025-17688

Analysis Generated

Mar 14, 2026 - 19:49 vuln.today

CVE Published

Jun 10, 2025 - 15:15 nvd

HIGH 7.3

DescriptionCVE.org

A hardcoded key in Ivanti Workspace Control before version 10.19.10.0 allows a local authenticated attacker to decrypt the stored environment password.

AnalysisAI

Cryptographic weakness in Ivanti Workspace Control versions before 10.19.10.0 where a hardcoded encryption key is embedded in the application, allowing authenticated local attackers to decrypt stored environment passwords. This vulnerability enables privilege escalation and lateral movement within affected environments. The CVSS 7.3 score reflects high confidentiality and integrity impact, though exploitation requires local access and user authentication; KEV and active exploitation status are not confirmed in available intelligence.

Technical ContextAI

The vulnerability stems from CWE-321 (Use of Hard-Coded Cryptographic Key), a fundamental cryptographic implementation flaw where sensitive data encryption relies on a static, non-unique key embedded in application binaries or configuration files. Ivanti Workspace Control (CPE likely: cpe:2.3:a:ivanti:workspace_control:*:*:*:*:*:*:*:*) uses this hardcoded key to encrypt environment passwords stored on disk. Since the key is constant across all installations and discoverable through reverse engineering, binary analysis, or disclosed intelligence, any authenticated local user can extract stored password ciphertexts and decrypt them using the known key. This violates cryptographic best practices (per OWASP and NIST guidelines) which mandate per-instance or per-user derived keys. The root cause indicates inadequate secrets management architecture, likely lacking key derivation functions (KDF) or secure key storage mechanisms (e.g., Windows DPAPI, HSM integration).

RemediationAI

IMMEDIATE: Upgrade Ivanti Workspace Control to version 10.19.10.0 or later (confirmed patched version from description). 2. VERIFICATION: Consult official Ivanti Security Advisory (referenced vendor advisory should be retrieved from Ivanti security bulletins at ivanti.com/security); confirm patch deployment across all affected installations. 3. POST-PATCH: Audit and rotate all environment passwords previously encrypted with the hardcoded key, as historical ciphertexts may be compromised. 4. DETECTION: Implement monitoring for suspicious local credential access patterns or mass decryption attempts in audit logs. 5. WORKAROUND (temporary, until patching): Restrict local access to Workspace Control configuration and cache directories via file system permissions; disable local user accounts with unnecessary privileges; monitor for unauthorized access to encrypted credential stores. 6. MITIGATION: Implement application whitelisting and privilege monitoring tools to restrict unauthorized credential extraction; use EDR solutions to detect anomalous local process credential access.