RCE in Acl Analytics
CVE-2018-25320
ACL Analytics versions 11.x through 13.0.0.579 contain an arbitrary code execution vulnerability that allows attackers to execute arbitrary commands by leveraging the EXECUTE function. Attackers can use bitsadmin to download malicious PowerShell scripts and execute them with system privileges to establish reverse shells and gain complete system control.
Vulnerability class: RCE (Remote Code Execution)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.006 (45.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 45th percentile — 45.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.006 · change: 0.000
Affected products
- Acl Analytics — versions 11.x - 13.0.0.579, 11.0
Weakness classification (CWE)
References
- www.acl.com (product)
- www.acl.com/products/acl-analytics/ (product)
- www.exploit-db.com/exploits/44281 (exploit)
- www.vulncheck.com/advisories/acl-analytics-11-x-arbitrary-code-execution (third-party-advisory)
Frequently asked questions
- What is CVE-2018-25320?
- CVE-2018-25320 is a critical-severity vulnerability in Acl Analytics, classified under Code Injection. CVSS score: 9.8/10. Published 2026-05-17.
- How severe is CVE-2018-25320?
- Critical severity. CVSS v3 base score is 9.8 out of 10.