What is the CVSS score of CVE-2025-53867?

CVE-2025-53867 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of Island Lake WebBatch are affected by CVE-2025-53867?

Island Lake Consulting's WebBatch prior to version 2025C contains a critical remote code execution vulnerability (CVSS 9.8) that requires no authentication or user interaction, allowing attackers to…

How to fix or mitigate CVE-2025-53867?

Within 24 hours: Inventory all systems running WebBatch, document versions, and assess network exposure and operational criticality. Within 7 days: Restrict network access to WebBatch instances to trusted internal networks only via firewall rules; deploy web application firewall signatures to block code injection patterns in URL parameters; enable audit logging of all WebBatch requests and process execution. Within 30 days: Deploy Island Lake Consulting WebBatch version 2025C immediately upon release and verify the vulnerability is resolved through testing.

Island Lake WebBatch CVE-2025-53867

CRITICAL

Code Injection (CWE-94)

2025-07-17 cve@mitre.org

Code Injection RCE

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 01:28 vuln.today

DescriptionCVE.org

Island Lake WebBatch before 2025C allows Remote Code Execution via a crafted URL.

AnalysisAI

Remote code execution in Island Lake Consulting's WebBatch prior to version 2025C allows remote attackers to run arbitrary code by supplying a crafted URL. Rated CVSS 9.8 with an unauthenticated network vector (PR:N/UI:N), the flaw stems from code injection (CWE-94) in the product's URL handling, giving full confidentiality, integrity, and availability compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-interaction profile makes it a high-priority patch candidate.