Critical severity · published Sep 23, 2025
CVE-2025-9588
OS Command Injection in Iron Mountain's enVision
9.8
CVSS
1.1%
EPSS
No
On KEV
Description
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Iron Mountain Archiving Services Inc. EnVision allows Command Injection.
This issue affects enVision: before 250563.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 66% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EN
enVision · Iron Mountain Archiving Services Inc.
before 250563 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-9588
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-9588
siberguvenlik.gov.tr
https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0285
Third Party Advisory
https://www.usom.gov.tr/bildirim/tr-25-0285
More from enVision
8.8
CVE-2026-86595
SQLi in Iron Mountain's enVision