What is CVE-2025-15559?

CVE-2025-15559 is a critical-severity vulnerability in Nestersoft Worktime, classified under OS Command Injection. CVSS score: 9.8/10. Published 2026-02-19.

How severe is CVE-2025-15559?

Critical severity. CVSS v3 base score is 9.8 out of 10.

RCE in Nestersoft Worktime

CVE-2025-15559

An unauthenticated attacker can inject OS commands when calling a server API endpoint in NesterSoft WorkTime. The server API call to generate and download the WorkTime client from the WorkTime server is vulnerable in the “guid” parameter. This allows an attacker to execute arbitrary commands on the WorkTime server as NT Authority\SYSTEM with the highest privileges. Attackers are able to access or manipulate sensitive data and take over the whole server.

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.004 (36.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Nestersoft Worktime
Nestersoft Inc. Worktime (On-prem/cloud) — versions <= 11.8.8

Weakness classification (CWE)

CWE-78 — OS Command Injection

References

551230f0-3615-47bd-b7cc-93e92e730bbf (Third Party Advisory, third-party-advisory)

Frequently asked questions

What is CVE-2025-15559?: CVE-2025-15559 is a critical-severity vulnerability in Nestersoft Worktime, classified under OS Command Injection. CVSS score: 9.8/10. Published 2026-02-19.
How severe is CVE-2025-15559?: Critical severity. CVSS v3 base score is 9.8 out of 10.