What is the CVSS score of CVE-2025-6926?

CVE-2025-6926 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Ubuntu are affected by CVE-2025-6926?

CVE-2025-6926 presents significant security risk, a improper authentication vulnerability rated CVSS 8.8.. A patch is available.

How to fix or mitigate CVE-2025-6926?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Audit authentication configurations and rotate any potentially compromised credentials.

Ubuntu CVE-2025-6926

EUVD-2025-19884 HIGH

Improper Authentication (CWE-287)

2025-07-03 c4f26cc8-17ff-4c99-b5e2-38fc1793eacc

Authentication Bypass Ubuntu Debian

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Ubuntu

MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 16, 2026 - 02:12 euvd

EUVD-2025-19884

Analysis Generated

Mar 16, 2026 - 02:12 vuln.today

CVE Published

Jul 03, 2025 - 17:15 nvd

HIGH 8.8

DescriptionCVE.org

Improper Authentication vulnerability in Wikimedia Foundation Mediawiki - CentralAuth Extension allows : Bypass Authentication.This issue affects Mediawiki - CentralAuth Extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.

Analysis

Technical ContextAI

An authentication bypass vulnerability allows attackers to circumvent login mechanisms and gain unauthorized access without valid credentials. This vulnerability is classified as Improper Authentication (CWE-287).

RemediationAI

Implement robust authentication mechanisms. Use multi-factor authentication. Review authentication logic for bypass conditions. Remove default credentials.

Same weakness CWE-287 – Improper Authentication

View all

CVE-2020-0688 HIGH POC

8.8

CVE-2023-46805 HIGH POC

8.2

CVE-2015-1187 CRITICAL POC

9.8

CVE-2024-7593 CRITICAL POC

9.8

CVE-2017-7921 CRITICAL POC

9.8

CVE-2024-53704 CRITICAL POC

9.8

CVE-2015-7755 CRITICAL POC

9.8

CVE-2013-0625 CRITICAL POC

9.8

Same technique Authentication Bypass

View all

CVE-2023-22515 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2013-2465 CRITICAL POC

9.8

CVE-2011-3544 CRITICAL POC

9.8

CVE-2012-1723 CRITICAL POC

9.8

CVE-2017-10271 HIGH POC

7.5

CVE-2015-1427 CRITICAL POC

9.8

CVE-2025-3248 CRITICAL POC

9.8

Vendor StatusVendor

Ubuntu

Priority: Medium

mediawiki

Release	Status	Version
bionic	needs-triage	-
focal	needs-triage	-
jammy	needs-triage	-
noble	needs-triage	-
upstream	released	1:1.43.3+dfsg-1
plucky	ignored	end of life, was needs-triage
oracular	ignored	end of life, was needs-triage
questing	needs-triage	-

Debian

mediawiki

Release	Status	Fixed Version	Urgency
bullseye	fixed	1:1.35.13-1+deb11u4	-
bullseye (security)	fixed	1:1.35.13-1+deb11u6	-
bookworm, bookworm (security)	fixed	1:1.39.17-1~deb12u1	-
trixie (security), trixie	fixed	1:1.43.6+dfsg-1~deb13u1	-
forky, sid	fixed	1:1.43.6+dfsg-2	-
bookworm	fixed	1:1.39.13-1~deb12u1	-
(unstable)	fixed	1:1.43.3+dfsg-1	-

DLA-4249-1 DSA-5957-1

CVE-2025-6926 vulnerability details – vuln.today

Back

Ubuntu CVE-2025-6926

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

Analysis

Technical ContextAI

RemediationAI

Same weakness CWE-287 – Improper Authentication

Same technique Authentication Bypass

Vendor StatusVendor

Ubuntu

Debian

Share

External POC / Exploit Code