CVE-2025-50572

8.8 highEPSS 0.4%

High (8.8). EPSS 0.4% chance of exploitation in the next 30 days.

Archer 6.11.00204.10014 allows attackers to execute arbitrary code via crafted system inputs that would be exported into the CSV and be executed after the user opened the file with compatible applications. NOTE: the Supplier does not accept this as a valid vulnerability report against their product.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 37% of CVEs (scores of 2026-10-31)
CWE: CWE-1236
Published: 2025-07-31
Modified: 2026-07-05
Record from: the NVD, synced 2026-10-19

References

https://github.com/shorooq-hummdi/Archer-csv-injection-command-exec/blob/main/README.md
https://www.archerirm.community/s/blogs/formula-injection-into-csv-files-vulnerability-in-rsa-archer-6-1-x-and-higher-MCOCQFO3WCQBCCHMKNC74JGSFWQY

Check your stack JSON