High severity · published Jul 27, 2026
CVE-2025-59172
Improper Neutralization of Special Elements used in an OS Command Vulnerability
8.5
CVSS
0.3%
EPSS
No
On KEV
Description
Ericsson Packet Core Controller (PCC) versions prior to 1.38 contain an Improper Neutralization of Special Elements vulnerability allowing an attacker to execute arbitrary code as root.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PC
Packet Core Controller (PCC) · Ericsson
before 1.38 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-59172
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-59172
www.ericsson.com
https://www.ericsson.com/en/about-us/security/psirt/security-bulletin-pcc-july-2026
More from Packet Core Controller (PCC)
5.3
CVE-2024-53828
Ericsson Packet Core Controller (PCC) - Improper Handling of Syntactically Invalid Structure Vulnerability
5.1
CVE-2025-59180
Use of Hard-coded Credentials Vulnerability
4.8
CVE-2025-59181
Path traversal Vulnerability
4.8
CVE-2025-59178
Exposure of Sensitive System Information to an Unauthorized Control Sphere Vulnerability