RCE in Accela Automation Platform
CVE-2025-57644
Accela Automation Platform 22.2.3.0.230103 contains multiple vulnerabilities in the Test Script feature. An authenticated administrative user can execute arbitrary Java code on the server, resulting in remote code execution. In addition, improper input validation allows for arbitrary file write and server-side request forgery (SSRF), enabling interaction with internal or external systems. Successful exploitation can lead to full server compromise, unauthorized access to sensitive data, and further network exploitation.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.007 (49.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.
Affected products
- Accela Automation_platform — versions 22.2.3.0.230103
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (Product)
- cve@mitre.org (Third Party Advisory, Mitigation)
Frequently asked questions
- What is CVE-2025-57644?
- CVE-2025-57644 is a critical-severity vulnerability in Accela Automation Platform, classified under Improper Input Validation. CVSS score: 9.1/10. Published 2025-09-19.
- How severe is CVE-2025-57644?
- Critical severity. CVSS v3 base score is 9.1 out of 10.
- Is CVE-2025-57644 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.