What is the CVSS score of CVE-2025-70995?

CVE-2025-70995 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Aranda Service Desk Web Edition are affected by CVE-2025-70995?

A critical vulnerability in Aranda Service Desk Web Edition allows authenticated users to execute arbitrary code on affected systems, potentially enabling attackers to compromise service desk…

How to fix or mitigate CVE-2025-70995?

Within 24 hours: Identify all instances of Aranda Service Desk Web Edition 8.6 in production and restrict administrative access to trusted personnel only. Within 7 days: Implement network segmentation to isolate ASDK systems from critical business infrastructure and enable enhanced logging of file upload activities. Within 30 days: Contact Aranda for patch availability, evaluate migration to patched versions, or consider alternative service desk solutions if patches are not forthcoming.

Aranda Service Desk Web Edition CVE-2025-70995

HIGH

Code Injection (CWE-94)

2026-03-05 cve@mitre.org

RCE Code Injection

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 27, 2026 - 19:22 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 21:16 nvd

HIGH 8.8

DescriptionCVE.org

An issue in Aranda Service Desk Web Edition (ASDK API 8.6) allows authenticated attackers to achieve remote code execution due to improper validation of uploaded files. An authenticated user can upload a crafted web.config file by sending a crafted POST request to /ASDKAPI/api/v8.6/item/addfile, which is processed by the ASP.NET runtime. The uploaded configuration file alters the execution context of the upload directory, enabling compilation and execution of attacker-controlled code (e.g., generation of an .aspx webshell). This allows remote command execution on the server without user interaction beyond authentication, impacting both On-Premise and SaaS deployments.

AnalysisAI

An issue in Aranda Service Desk Web Edition (ASDK API 8.6) allows authenticated attackers to achieve remote code execution due to improper validation of uploaded files. [CVSS 8.8 HIGH]

Technical ContextAI

Classified as CWE-94 (Code Injection). An issue in Aranda Service Desk Web Edition (ASDK API 8.6) allows authenticated attackers to achieve remote code execution due to improper validation of uploaded files. An authenticated user can upload a crafted web.config file by sending a crafted POST request to /ASDKAPI/api/v8.6/item/addfile, which is processed by the ASP.NET runtime. The uploaded configuration file alters the execution context of the upload directory, enabling compilation and execution of attacker-controlled code (e.g., gene