What’s Vulnerable › Vulnerabilities
CVE-2025-3651: Command Injection in iManage Work Desktop for Mac's Agent Service
- Severity: critical (CVSS 9.3 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-04-17 · updated 2026-06-17
- Weakness: CWE-346
Description
Improper Verification of Source of a Communication Channel in Work Desktop for Mac versions 10.8.1.46 and earlier allows attackers to execute arbitrary commands via unauthorized access to the Agent service. This has been remediated in Work Desktop for Mac version 10.8.2.33.
Affected products
- iManage Work Desktop for Mac: before 10.8.2.33 — fixed in 10.8.2.33
How to fix
Upgrade to a fixed version: iManage Work Desktop for Mac 10.8.2.33. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-3651 or the next vulnerability affects your stack