What’s Vulnerable › Vulnerabilities

CVE-2025-59090: Unauthenticated SOAP API in dormakaba Kaba exos 9300

• Severity: critical (CVSS 9.3 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-01-26 · updated 2026-06-17
• Weakness: CWE-306

Description

On the exos 9300 server, a SOAP API is reachable on port 8002. This API does not require any authentication prior to sending requests. Therefore, network access to the exos server allows e.g. the creation of arbitrary access log events as well as querying the 2FA PINs associated with the enrolled chip cards.

Affected products

• dormakaba Kaba exos 9300: before 4.4.0 manual mitigation needed — fixed in 4.4.0 with 92xx-K7 secured by default

How to fix

Upgrade to a fixed version: dormakaba Kaba exos 9300 4.4.0 with 92xx-K7 secured by default. Check the vendor advisory for mitigations.

References

• https://r.sec-consult.com/dkexos
• https://r.sec-consult.com/dormakaba
• https://www.dormakabagroup.com/en/security-advisories

Get alerted when CVE-2025-59090 or the next vulnerability affects your stack