CVE-2025-27819

highpriority · track · 0EPSS 0.010 · 64 %ileDEEURUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

1.03% (64th) EPSS

CVSS 8.8 · high

Is it mine?

35 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-27

In CVE-2023-25194, we announced the RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration in Kafka Connect API. But not only Kafka Connect API is vulnerable to this attack, the Apache Kafka brokers also have this vulnerability. To exploit this vulnerability, the attacker needs to be able to connect to the Kafka cluster and have the AlterConfigs permission on the cluster resource. Since Apache Kafka 3.4.0, we have added a system property ("-Dorg.apache.kafka.disallowed.login.modules") to disable the problematic login modules usage in SASL JAAS configuration. Also by default "com.sun.security.auth.module.JndiLoginModule" is disabled in Apache Kafka 3.4.0, and "com.sun.security.auth.module.JndiLoginModule,com.sun.security.auth.module.LdapLoginModule" is disabled by default in in Apache Kafka 3.9.1/4.0.0

cvss

Technical severity, 0–10. One row per scoring source.

8.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.9–8.8

v3.18.8highAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · ENISA EU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondaryexploitability 3.9 · impact 3.6

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · OSV

v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-502USCWE-502USCWE-502US

affected products (35)

Products and version ranges known to be affected.

Apache Kafka <3.9.1all versionscert_bundDE
Apache Kafka <4.0.0all versionscert_bundDE
IBM App Connect Enterprise 12.0.1.0-12.0.12.15all versionscert_bundDEcpe:/a:ibm:app_connect_enterprise:12.0.1.0_-_12.0.12.15
IBM App Connect Enterprise 13.0.1.0-13.0.4.0all versionscert_bundDEcpe:/a:ibm:app_connect_enterprise:13.0.1.0_-_13.0.4.0
IBM App Connect Enterprise <12.14.0all versionscert_bundDE
IBM App Connect Enterprise <LTS 12.0.14all versionscert_bundDE
IBM Business Automation Workflowall versionscert_bundDEcpe:/a:ibm:business_automation_workflow:-
IBM InfoSphere Data Replicationall versionscert_bundDEcpe:/a:ibm:infosphere_data_replication:-
IBM InfoSphere Information Serverall versionscert_bundDEcpe:/a:ibm:infosphere_information_server:-
IBM Integration Bus for z/OS 10.1.0.0-10.1.0.5all versionscert_bundDEcpe:/a:ibm:integration_bus:10.1.0.0_-_10.1.0.5::for_zos
IBM Maximo Asset Management 7.6.1all versionscert_bundDEcpe:/a:ibm:maximo_asset_management:7.6.1
IBM Operational Decision Managerall versionscert_bundDEcpe:/a:ibm:operational_decision_manager:-
IBM QRadar SIEM <7.5.0 UP13all versionscert_bundDE
IBM Security Guardium 11.5all versionscert_bundDEcpe:/a:ibm:security_guardium:11.5
IBM Tivoli Network Manager IP Edition <4.2 Fix Pack 23all versionscert_bundDE
Red Hat Enterprise Linuxall versionscert_bundDEcpe:/o:redhat:enterprise_linux:-
Apache Kafka< 3.9.1cert_bundDE
Apache Kafka< 4.0.0cert_bundDE
IBM App Connect Enterprise< 12.14.0cert_bundDE
IBM App Connect Enterprise< LTS 12.0.14cert_bundDE

showing 20 of 35

advisories (3)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2025-1269Apache Kafka: Mehrere SchwachstellenDeutsch2025-06-09csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Apache Kafka ausnutzen, um Informationen offenzulegen, beliebigen Programmcode auszuführen oder einen Denial-of-Service auszulösen.
GHSA-mcwh-c9pg-xw43Apache Kafka Deserialization of Untrusted Data vulnerability2025-06-10ghsa · osvUS
In CVE-2023-25194, we announced the RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration in Kafka Connect API. But not only Kafka Connect API is vulnerable to this attack, the Apache Kafka brokers also have this vulnerability. To exploit this vulnerability, the attacker needs to be able to connect to the Kafka cluster and have the AlterConfigs permission on the cluster resource. Since Apache Kafka 3.4.0, we have added a system property ("-Dorg.apache.kafka.disallowed.login.modules") to disable the problematic login modules usage in SASL JAAS configuration. Also by default "com.sun.security.auth.module.JndiLoginModule" is disabled in Apache Kafka 3.4.0, and "com.sun.security.auth.module.JndiLoginModule,com.sun.security.auth.module.LdapLoginModule" is disabled by default in in Apache Kafka 3.9.1/4.0.0
BIT-kafka-2025-27819Apache Kafka: Possible RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration2025-06-14vendor · osvUS
In CVE-2023-25194, we announced the RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration in Kafka Connect API. But not only Kafka Connect API is vulnerable to this attack, the Apache Kafka brokers also have this vulnerability. To exploit this vulnerability, the attacker needs to be able to connect to the Kafka cluster and have the AlterConfigs permission on the cluster resource. Since Apache Kafka 3.4.0, we have added a system property ("-Dorg.apache.kafka.disallowed.login.modules") to disable the problematic login modules usage in SASL JAAS configuration. Also by default "com.sun.security.auth.module.JndiLoginModule" is disabled in Apache Kafka 3.4.0, and "com.sun.security.auth.module.JndiLoginModule,com.sun.security.auth.module.LdapLoginModule" is disabled by default in in Apache Kafka 3.9.1/4.0.0

also known as (6)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu osv cert_bund NVD CVE.org MITRE

published 2025-06-10modified 2026-06-17

references (6)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan