CVE-2025-35041

highpriority · track · 0EPSS 0.003 · 26 %ileEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.33% (26th) EPSS

CVSS 7.5 · high

Is it mine?

16 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · cisa_csaf_it · nvd

EPSS · scored 2026-10-27

Airship AI Acropolis allows unlimited MFA attempts for 15 minutes after a user has logged in with valid credentials. A remote attacker with valid credentials could brute-force the 6-digit MFA code. Fixed in 10.2.35, 11.0.21, and 11.1.9.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedAcropoliscisa_csaf_it
Fixed in 10.2.35, 11.0.21, and 11.1.9.

cvss

Technical severity, 0–10. One row per scoring source.

7.7

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5.2–7.7

v3.17.5highCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · CISA US

v3.17.5highCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondaryexploitability 1.6 · impact 5.9

v4.07.7highCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:Nsecondary · ENISA EU

v4.07.7highCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary

v4.05.2mediumCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-307USCWE-307US

affected products (16)

Products and version ranges known to be affected.

Airship AI Acropolis 10.2.35all versionsfixedcisa_csaf_itUS
Airship AI Acropolis 11.0.21all versionsfixedcisa_csaf_itUS
Airship AI Acropolis 11.1.9all versionsfixedcisa_csaf_itUS
Airship AI Acropolis <10.2.35all versionscisa_csaf_itUS
Airship AI Acropolis <11.0.21all versionscisa_csaf_itUS
Airship AI Acropolis <11.1.9all versionscisa_csaf_itUS
Airship AI Acropolisall versionsfixedcisa_csaf_itUS
Airship AI Acropolis< 10.2.35cisa_csaf_itUS
Airship AI Acropolis< 11.0.21cisa_csaf_itUS
Airship AI Acropolis< 11.1.9cisa_csaf_itUS
Airship AI Acropolis0 → 10.2.35enisa_euvdEU
Airship AI Acropolis0 → 11.0.21enisa_euvdEU
Airship AI Acropolis0 → 11.1.9enisa_euvdEU
airship.ai acropolis< 10.2.35nvdUScpe:2.3:a:airship.ai:acropolis:*:*:*:*:*:*:*:*
airship.ai acropolis11.0.0 → 11.0.21nvdUScpe:2.3:a:airship.ai:acropolis:*:*:*:*:*:*:*:*
airship.ai acropolis11.1.0 → 11.1.9nvdUScpe:2.3:a:airship.ai:acropolis:*:*:*:*:*:*:*:*

advisories (1)

Vendor and ecosystem advisories describing this.

VA-25-265-01Airship AI MFA bypass and default credentials vulnerabilities2025-09-22csaf · cisa_csaf_itUS
Airship AI Acropolis is used for video and data management. In versions before 11.1.9, 11.0.21, and 10.2.35, a remote unauthenticated attacker with valid credentials can brute force the MFA code and authenticate without an additional authentication method. Improperly configured systems could also allow an attacker to log in with unchanged default credentials.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd cisa_csaf_it nvd NVD CVE.org MITRE

published 2025-09-22modified 2026-06-17

references (6)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan