What is the CVSS score of CVE-2025-9986?

CVE-2025-9986 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2025-9986?

Within 24 hours: Identify all systems running Vadi products and isolate affected infrastructure from external networks if possible; notify stakeholders and legal/compliance teams. Within 7 days: Implement network segmentation to restrict access to Vadi systems; deploy WAF rules to block suspicious data exfiltration patterns; conduct urgent audit of system logs for unauthorized access. Within 30 days: Develop vendor communication plan for patch timeline; evaluate alternative solutions or vendors; implement enhanced monitoring and threat detection for affected systems; complete full data exposure assessment.

CVE-2025-9986

HIGH

Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497)

2026-02-11 iletisim@usom.gov.tr

Information Disclosure

8.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 11, 2026 - 09:15 nvd

HIGH 8.2

DescriptionCVE.org

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Vadi Corporate Information Systems Ltd. Co. DIGIKENT allows Excavation.This issue affects DIGIKENT: through 13092025.

AnalysisAI

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Vadi Corporate Information Systems Ltd. Co. [CVSS 8.2 HIGH]

Technical ContextAI

Affects Vadi Corporate Information Systems Ltd. Co. DIGIKENT. Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Vadi Corporate Information Systems Ltd. Co. DIGIKENT allows Excavation.This issue affects DIGIKENT: through 13092025.