What is the CVSS score of CVE-2025-59895?

CVE-2025-59895 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Diskpulse are affected by CVE-2025-59895?

Sync Breeze Enterprise Server and Disk Pulse Enterprise versions 10.4.18 contain a remote denial-of-service vulnerability that could render these file synchronization and monitoring systems…

How to fix or mitigate CVE-2025-59895?

Within 24 hours: Identify all systems running Sync Breeze Enterprise v10.4.18 or Disk Pulse Enterprise v10.4.18 and document exposure scope. Within 7 days: Implement network segmentation to restrict administrative access to the configuration restore functionality and monitor for suspicious restore attempts. Within 30 days: Evaluate vendor updates or alternative solutions; contact the vendor for patch availability timeline and consider upgrading to patched versions when released.

Diskpulse CVE-2025-59895

HIGH

Improper Input Validation (CWE-20)

2026-01-28 cve-coordination@incibe.es

Denial Of Service Code Injection Diskpulse Syncbreeze Flexense

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 28, 2026 - 12:15 nvd

HIGH 7.5

DescriptionCVE.org

Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a remote denial-of-service (DoS) vulnerability in the configuration restore functionality. The issue is due to insufficient validation of user-supplied data during this process. An attacker could send malicious requests to alter the configuration file, causing the application to become unresponsive. In a successful scenario, the service may not recover on its own and require a complete reinstallation, as the configuration becomes corrupted and prevents the service from restarting, even manually.

AnalysisAI

Technical ContextAI

Classified as CWE-20 (Improper Input Validation). Affects the configuration restore component of Diskpulse. Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a remote denial-of-service (DoS) vulnerability in the configuration restore functionality. The issue is due to insufficient validation of user-supplied data during this process. An attacker could send malicious requests to alter the configuration file, causing the application to become unresponsive. In a successful scenario, the service may not recover on its own and require a complete reinstallation, as the config