What is the CVSS score of CVE-2025-41726?

CVE-2025-41726 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2025-41726?

Within 24 hours: Identify and inventory all Device Manager deployments and assess network exposure; implement network segmentation to restrict access to Device Manager web services to trusted networks only. Within 7 days: Deploy WAF rules to block malformed requests to Device Manager APIs; disable non-essential Device Manager features if operationally feasible; establish enhanced monitoring for suspicious API calls and process execution from Device Manager processes. Within 30 days: Coordinate with vendor for patch availability and release timeline; develop and test patch deployment procedures; execute patching in staged approach across non-production environments first.

CVE-2025-41726

HIGH

Integer Overflow or Wraparound (CWE-190)

2026-01-27 info@cert.vde.com

Integer Overflow RCE

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Jan 27, 2026 - 12:15 nvd

HIGH 8.8

DescriptionCVE.org

A low privileged remote attacker can execute arbitrary code by sending specially crafted calls to the web service of the Device Manager or locally via an API and can cause integer overflows which then may lead to arbitrary code execution within privileged processes.

AnalysisAI

Technical ContextAI

Classified as CWE-190 (Integer Overflow or Wraparound). A low privileged remote attacker can execute arbitrary code by sending specially crafted calls to the web service of the Device Manager or locally via an API and can cause integer overflows which then may lead to arbitrary code execution within privileged processes.

Affected ProductsAI

A low privileged remote attacker can execute arbitrary code by sending specially crafted calls to the web service of the Device Manager or locally via