High severity · published Mar 4, 2026
CVE-2025-59785
API - Insufficient Input Validation
7.2
CVSS
0.2%
EPSS
No
On KEV
Description
Improper validation of API end-point in 2N Access Commander version 3.4.2 and prior allows attacker to bypass password policy for backup file encryption.
This vulnerability can only be exploited after authenticating with administrator privileges.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
2A
2N Access Commander · 2N Telekomunikace a.s.
before 3.5 · source: vendor
AC
Access Commander · 2n
before 3.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-59785
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-59785
Vendor Advisory
https://www.2n.com/en-GB/download/cve_2025_59785_acom_3_5_v1pdf
More from 2N Access Commander
9.8
CVE-2025-59786
Cookies are not Invalidated upon Logout and Password Change
7.2
CVE-2025-59784
Log Pollution - Control Characters Not Escaped
7.2
CVE-2025-59783
OS Command Injection over API
6.5
CVE-2025-59787
HTTP 5XX Internal Server Errors