High severity · published Jan 20, 2026
CVE-2025-14376
Verve Asset Manager – Plaintext Storage Vulnerabilities
8.6
CVSS
0.1%
EPSS
No
On KEV
Description
A security issue was discovered within the legacy ADI server component of Verve Asset Manager, caused by plaintext secrets stored in environment variables on the ADI server. This component has been retired and has been optional since the 1.36 release in 2024.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 3% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VA
Verve Asset Manager · Rockwell Automation
1.33 1.34 1.35 1.36 1.37 1.38 1.39 1.40 1.41 1.41.1 1.41.2 1.41.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-14376
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-14376
www.rockwellautomation.com
https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1767.html
More from Verve Asset Manager
8.8
CVE-2025-14377
Verve Asset Manager – Plaintext Storage Vulnerabilities
8.4
CVE-2025-11862
Verve Asset Manager Access Control Vulnerability