CVE-2025-6076: CVE-2025-6076

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-08-02 · updated 2026-06-17

Description

Partner Software's Partner Software application and Partner Web application do not sanitize files uploaded on the "reports" tab, allowing an authenticated attacker to upload a malicious file and compromise the device. By default, the software runs as SYSTEM, heightening the severity of the vulnerability.

Affected products

Partner Software Partner Web: from 4.32 before 4.32.2 — fixed in 4.32.2

How to fix

Upgrade to a fixed version: Partner Software Partner Web 4.32.2. Check the vendor advisory for mitigations.

References

https://partnersoftware.com/resources/software-release-info-4-32/
https://kb.cert.org/vuls/id/317469
https://www.kb.cert.org/vuls/id/317469

Get alerted when CVE-2025-6076 or the next vulnerability affects your stack