What’s Vulnerable › Vulnerabilities
CVE-2025-64113: Emby Server allows attackers to gain administrative server access without preconditions
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.6% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-12-09 · updated 2026-10-14
- Weakness: CWE-640
Description
Emby Server is a user-installable home media server. Versions below 4.9.1.81 allow an attacker to gain full administrative access to an Emby Server (for Emby Server administration, not at the OS level). Other than network access, no specific preconditions need to be fulfilled for a server to be vulnerable. This issue is fixed in version 4.9.1.81.
Affected products
- EmbySupport Emby.Security: before 4.9.1.90; 4.9.2.6-beta — fixed in 4.9.1.90
How to fix
Upgrade to a fixed version: EmbySupport Emby.Security 4.9.1.90. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-64113 or the next vulnerability affects your stack