High severity · published Apr 14, 2026
CVE-2025-7389
Unauthorized Arbitrary File Read via RMI in AdminServer Interface
8.2
CVSS
0.3%
EPSS
No
On KEV
Description
A vulnerability in the AdminServer component of OpenEdge on all supported platforms grants its authenticated users OS-level access to the server
through the adopted authority of the AdminServer process itself. The delegated authority of the AdminServer could allow its users the ability to read arbitrary files on the host system through the misuse of the setFile() and openFile()
methods exposed through the RMI interface. Misuse was limited only by OS-level authority of the AdminServer's elevated
privileges granted and the user's access to these methods enabled through RMI. The exploitable methods have been removed thus eliminating their access through RMI or downstream of the RMI registry.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 25% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
OpenEdge · Progress Software Corporation
OpenEdge 12.2.0 through 12.2.9; OpenEdge 12.8.0 through 12.2.18 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-7389
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-7389
community.progress.com
https://community.progress.com/s/article/Important-Arbitrary-File-Ready-Security-Update-for-OpenEdge-AdminServer
More from OpenEdge
9.1
CVE-2025-8095
Recoverable obfuscation using the OECH1 prefix encoding in OpenEdge
