Low severity · published Jan 22, 2026
CVE-2025-12738
Enumeration of restricted property value
1.3
CVSS
0.4%
EPSS
No
On KEV
Description
Neo4j Enterprise edition versions prior to 2025.11.2 and 5.26.17 are vulnerable to a potential information disclosure by an attacker who has some legitimate access to the database. The vulnerability allows attacker without read access to a property to infer information about its value by trying to enumerate all possible values through observing error messages of SET property. We recommend upgrading to 2025.11.2 or 5.26.17 and above, where the issues is fixed.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EE
Enterprise Edition · neo4j
before 2025.11.2; before 5.26.17 · source: vendor
Affected product
EE
Enterprise Edition
neo4j
More from Enterprise Edition
9.8
CVE-2026-1524
Auth misconfiguration when multiple providers enabled
7.5
CVE-2026-14587
Unathenticated connection can hold Bolt channel open
7.2
CVE-2026-1497
Incorrect privilege assignment in composite databases
6.5
CVE-2026-1471
Caching of authentication context
6.3
CVE-2025-11602
Untargeted information leak in Bolt protocol handshake