CVE-2025-5459

8.6 highEPSS 1.1%

High (8.6) in puppet puppet enterprise. EPSS 1.1% chance of exploitation in the next 30 days.

A user with specific node group editing permissions and a specially crafted class parameter could be used to execute commands as root on the primary host. It affects Puppet Enterprise versions 2018.1.8 through 2023.8.3 and 2025.3 and has been resolved in versions 2023.8.4 and 2025.4.0.

Severity

CVSS 4.0

8.6 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.1% chance of exploitation in the next 30 days; higher than 65% of CVEs (scores of 2026-10-31)
CWE: CWE-78
Published: 2025-06-26
Modified: 2026-09-04
Record from: the NVD, synced 2026-10-19

Affected

puppet:puppet_enterprise

References

https://portal.perforce.com/s/detail/a91PA000001SiDdYAK
http://seclists.org/fulldisclosure/2026/Sep/9

Check your stack JSON