Medium severity · published Jan 28, 2026
CVE-2025-57796
Use of a hardcoded static key to protect sensitive data in Explorance Blue
6.8
CVSS
0.2%
EPSS
No
On KEV
Description
Explorance Blue versions prior to 8.14.12 use reversible symmetric encryption with a hardcoded static key to protect sensitive data, including user passwords and system configurations. This approach allows stored values to be decrypted offline if the encrypted data are obtained.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 11% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BL
Blue · Explorance
before 8.14.12 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-57796
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-57796
Third Party Advisory
https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0005.md
Vendor Advisory
https://online-help.explorance.com/blue/articles/security-advisories-(january-2026)
Vendor Advisory
https://online-help.explorance.com/blue/articles/security-advisory:-cve-2025-57796
Product
https://www.explorance.com/products/blue
More from Blue
10.0
CVE-2025-57792
SQL Injection Vulnerability in Explorance Blue
9.9
CVE-2025-57795
Unauthenticated Remote File Download in Explorance Blue
9.1
CVE-2025-57794
Unrestricted File Upload Vulnerability in Explorance Blue
8.6
CVE-2025-57793
SQL Injection Vulnerability in Explorance Blue
6.1
CVE-2025-52344
Multiple Cross Site Scripting (XSS) vulnerabilities in input fields in Explorance Blue 8.1.2 allows attackers to inject arbitrary JavaScript code on the user's browser via the…