What is the CVSS score of CVE-2025-68825?

CVE-2025-68825 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of HCL Hive are affected by CVE-2025-68825?

HCL Hive 1.0 ships with overly permissive default permissions that expose containerized deployments to network-based lateral movement, container breakout, and inter-service communication interception…

How to fix or mitigate CVE-2025-68825?

Within 24 hours, audit all HCL Hive 1.0 deployments to confirm versions and document current permission configurations; immediately implement network segmentation to restrict unauthenticated access to Hive services. Within 7 days, enforce least-privilege permissions beyond defaults through access controls and authentication mechanisms, and establish network policies to restrict inter-container and inter-service communications. Within 30 days, evaluate migration pathways to alternative container orchestration platforms, establish continuous monitoring for exploitation attempts, and subscribe to HCL security advisories for patch notification.

HCL Hive CVE-2025-68825

EUVD-2025-210763 HIGH

Incorrect Default Permissions (CWE-276)

2026-08-24 HCL

GHSA-xpcx-m92f-xj7q

Privilege Escalation Hcl Hive

7.5

CVSS 3.1 · Vendor: HCL

Severity by source

Vendor (HCL) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

9.3 CRITICAL

Scope changed to C because container breakout crosses the container isolation boundary; I:L added since lateral movement implies write or execution capability in adjacent systems.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N

Primary rating from Vendor (HCL).

CVSS VectorVendor: HCL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 24, 2026 - 16:23 vuln.today

CVE Published

Aug 24, 2026 - 15:37 cve.org

HIGH 7.5

DescriptionCVE.org

HCL Hive is affected by incorrect default permissions which could allow an attacker unauthorized lateral movement, container breakout, and interception of sensitive internal communications.

AnalysisAI

Incorrect default permissions in HCL Hive 1.0 expose containerized deployments to unauthorized lateral movement, container breakout, and interception of sensitive inter-service communications by network-accessible attackers requiring no authentication. The flaw (CWE-276) means the platform ships with overly permissive defaults - not a misconfiguration by the operator - making any default deployment potentially vulnerable without additional hardening. No public exploit code exists at time of analysis, and the vulnerability has not been added to the CISA KEV catalog, but the combination of a network-accessible vector, no authentication requirement, and high confidentiality impact warrants prompt remediation.

Technical ContextAI

CWE-276 (Incorrect Default Permissions) indicates that HCL Hive 1.0 (CPE: cpe:2.3:a:hclsoftware:hcl_hive:*:*:*:*:*:*:*:*) ships with file system permissions, network policies, or inter-container access controls set more permissively than the principle of least privilege requires. In containerized or microservices platforms, this class of vulnerability typically manifests as containers running with excessive Linux capabilities, overly broad service account bindings, unrestricted inter-pod network policies, or world-readable mount points on shared volumes - any of which can be chained to escape container isolation, pivot to adjacent services, or passively intercept internal API traffic and credentials transiting the service mesh. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms the permissive defaults are reachable from the network without authentication, consistent with exposed management interfaces or inter-service endpoints lacking access controls.

RemediationAI

Consult the HCL Support knowledge base article KB0131731 (https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131731) for the primary remediation guidance; an exact patched release version is not specified in the available intelligence data, so the patch version should be confirmed directly with HCL before deployment. As compensating controls while a patch is applied: restrict network access to HCL Hive management and inter-service endpoints using firewall rules or network policies that enforce least-privilege communication paths between containers - this limits an attacker's ability to reach overly permissive endpoints. Audit and harden container runtime security contexts (drop unnecessary Linux capabilities, enforce read-only root filesystems, disable privilege escalation) to reduce the blast radius of any container breakout. Additionally, enable mTLS or equivalent encryption on internal service-to-service communications to mitigate the interception risk independently of the permission flaw. These controls reduce exposure but do not eliminate the root-cause permission defect; patching remains the definitive fix.