CVE-2025-27223

7.5 highEPSS 2.2%

High (7.5) in rocketsoftware trufusion enterprise. EPSS 2.2% chance of exploitation in the next 30 days.

TRUfusion Enterprise through 7.10.4.0 exposes the encrypted COOKIEID as an authentication mechanism for some endpoints such as /trufusionPortal/getProjectList. However, the application uses a static key to create the encrypted cookie, ultimately allowing anyone to forge cookies and gain access to sensitive internal information.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 2.2% chance of exploitation in the next 30 days; higher than 82% of CVEs (scores of 2026-10-31)
CWE: CWE-1004
Published: 2025-10-27
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

rocketsoftware:trufusion_enterprise

References

https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2025-27223.txt
https://www.rcesecurity.com/2025/09/when-audits-fail-four-critical-pre-auth-vulnerabilities-in-trufusion-enterprise/
https://www.rocketsoftware.com/products/rocket-b2b-supply-chain-integration/rocket-trufusion-enterprise

Check your stack JSON