What is the CVSS score of CVE-2025-59892?

CVE-2025-59892 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Diskpulse are affected by CVE-2025-59892?

A high-severity CSRF vulnerability in Sync Breeze Enterprise Server and Disk Pulse Enterprise v10.4.18 allows authenticated attackers to manipulate other logged-in users into performing unauthorized…

How to fix or mitigate CVE-2025-59892?

Within 24 hours: Identify all systems running Sync Breeze Enterprise Server or Disk Pulse Enterprise v10.4.18 and document affected users and data access levels. Within 7 days: Implement network segmentation to restrict application access to business-critical systems; deploy WAF rules to detect and block suspicious cross-origin requests; enforce same-site cookie policies; and disable unnecessary features if possible. Within 30 days: Establish a continuous monitoring program for vendor patch releases and prepare for immediate deployment; conduct user awareness training on phishing and social engineering risks that could be used to exploit this vulnerability.

Diskpulse CVE-2025-59892

HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-01-28 cve-coordination@incibe.es

CSRF Diskpulse Syncbreeze Flexense

8.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.0 HIGH

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 28, 2026 - 12:15 nvd

HIGH 8.0

DescriptionCVE.org

Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18. An authenticated user could cause another user to perform unwanted actions within the application they are logged into. This vulnerability is possible due to the lack of proper CSRF token implementation. Among other things, it is possible, using a POST request to delete commands individually via '/delete_command?sid=', using the 'cid' parameter.

AnalysisAI

Technical ContextAI

Classified as CWE-352 (Cross-Site Request Forgery (CSRF)). Affects Diskpulse. Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18. An authenticated user could cause another user to perform unwanted actions within the application they are logged into. This vulnerability is possible due to the lack of proper CSRF token implementation. Among other things, it is possible, using a POST request to delete commands individually via '/delete_command?sid=', using the 'cid' parameter.