Identity Agent CVE-2025-8305

Exploitation requires the attacker to already be an authenticated local user on a host running Check Point Identity Agent for Terminal Services, and requires that the agent's debug logging be producing the debug files in which sensitive identity data is written in plaintext. The attacker must have read access to those debug files on the local system. Limiting factors: no remote exploitation is possible (AV:L), the attacker must hold valid local credentials (PR:L), and realistically the debug files must exist/debug mode must have been generating output - making this primarily an insider or post-compromise escalation-of-access issue rather than a remotely reachable flaw.

This is a moderate-risk, low-priority information-disclosure issue rather than an urgent threat. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, base 6.5) is internally consistent with the description: exploitation requires an already-authenticated local user, low complexity, no user interaction, and yields high confidentiality impact with a scope change because the leaked data belongs to a different user/security authority (one user can claim another's security policy rules). There is no integrity or availability impact. EPSS is very low (0.12%, 2nd percentile), the CVE is NOT on the CISA KEV list, and no public exploit code is referenced - all three exploitation signals agree that real-world exploitation is improbable and there is no evidence of active use. The signals do not conflict: a local, authenticated prerequisite plus the absence of KEV/POC and a low EPSS all point to this being a credible but low-urgency insider/post-compromise issue, not a mass-exploitation or remote threat. The main caveat is sourcing: analysis rests on a single vendor reference (Check Point SK184264) with no NVD-enriched CPE data, so affected version ranges and the exact fix are not independently confirmed here.

An authenticated local user on a system running Check Point Identity Agent for Terminal Services reads the agent's debug files, which record sensitive identity/authorization data in plaintext. Using that leaked information, the attacker impersonates or 'claims' the security policy rules assigned to another user, gaining access intended for that victim. No public exploit code is identified at time of analysis, and because the attack vector is local and authenticated (PR:L), exploitation is limited to users who already have an account and local access to the host.