Is CVE-2025-48927 actively exploited?

Yes. CVE-2025-48927 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means exploitation in the wild has been confirmed.

Can CVE-2025-48927 be exploited remotely?

The attack vector of CVE-2025-48927 has not been classified yet.

What is the CVSS score of CVE-2025-48927?

CVE-2025-48927 has not received a CVSS score yet.

HOME VULNERABILITIESCVE-2025-48927

HIGHCISA KEVIN THE WILD

CVE-2025-48927

Published: July 1, 2025

EPSS:4.67%probability of exploitation in 30 daysPercentile:89.1th

Official Description

TeleMessage TM SGNL contains an initialization of a resource with an insecure default vulnerability. This vulnerability relies on how the Spring Boot Actuator is configured with an exposed heap dump endpoint at a /heapdump URI.

NVD Source

CISA KEV Advisory

TeleMessage TM SGNL Initialization of a Resource with an Insecure Default Vulnerability

Added to KEV: 2025-07-01Federal patch deadline: 2025-07-22

Required Action (CISA)

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Risk Analysis

TeleMessage TM SGNL has an insecure default configuration in its Spring Boot Actuator, exposing a heap dump endpoint. This allows attackers to potentially access sensitive information. Its inclusion in CISA's KEV and an EPSS score of 0.04675 highlight a significant and urgent risk of exploitation.

This vulnerability is actively exploited in the wild, as confirmed by its presence in CISA's KEV catalog. The exposed endpoint can be accessed remotely.

Recommended Action

Administrators should reconfigure the Spring Boot Actuator in TeleMessage TM SGNL to secure or disable the /heapdump endpoint. Review all default configurations for security best practices.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2025-48927 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CISA has added CVE-2025-48927 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.