CVE-2025-0896

9.2 criticalEPSS 2.5%

Critical (9.2) in orthanc-server orthanc. EPSS 2.5% chance of exploitation in the next 30 days.

Orthanc server prior to version 1.5.8 does not enable basic authentication by default when remote access is enabled. This could result in unauthorized access by an attacker.

Severity

CVSS 4.0

9.2 critical

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 2.5% chance of exploitation in the next 30 days; higher than 84% of CVEs (scores of 2026-10-31)
CWE: CWE-306
Published: 2025-02-13
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

orthanc-server:orthanc

References

https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-037-02

Check your stack JSON