CVE-2025-9317
The vulnerability, if exploited, could allow a miscreant with read access to Edge Project files or Edge Offline Cache files to reverse eng
CVSS
8.4
High
EPSS
0.1%
p1
KEV
—
Exploit Today
0
0-100
Published: Nov 15, 2025 · Last modified: Oct 18, 2026 · CWE-327
0.1%EPSS · 30 days0.1%
2026-09-242026-10-21
The vulnerability, if exploited, could allow a miscreant with read access to Edge Project files or Edge Offline Cache files to reverse engineer Edge users' app-native or Active Directory passwords through computational brute-forcing of weak hashes.
- github.comhttps://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-317-03.json
- www.aveva.comhttps://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2025-006.pdf
- www.cisa.govhttps://www.cisa.gov/news-events/ics-advisories/icsa-25-317-03
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-31615.9 MED10.4%
——3IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.3dCVE-2026-69303.7 LOW6.2%
——2IBM Concert 1.0 through 3.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.3dCVE-2026-591166.8 MED29.0%
——9Use of a broken or risky cryptographic algorithm in Windows Remote Desktop allows an unauthorized attacker to bypass a security feature over a network.9dCVE-2026-1028244.3 MED3.1%
——1Russh is a Rust SSH client and server library. Prior to 0.63.0, the hybrid ML-KEM 768 and X25519 implementation in russh/src/kex/hybrid_mlkem.rs accepts an all-zero 32-byte peer X25519 public key in both server_dh and compute_shared_secret, forcing the X25519 contribution to the combined shared secret to zero. A malicious SSH peer can therefore make the combined secret depend only on ML-KEM, defeating the hybrid exchange's intended fallback protection if ML-KEM is later weakened. This issue is fixed in version 0.63.0.23dCVE-2026-181043.3 LOW0.0%
——0IBM Db2 Mirror for i 7.6, 7.5, and 7.4 could allow a local attacker to obtain sensitive information due to the use of the AES Electronic Codebook (ECB) mode for encryption.24dCVE-2026-823567.5 HIG1.2%
——0Imprivata EAM <=26.2.6 lacks the ability to rotate its RSA key pair after deployment when generating an X.509 certificate. Using an RSA key pair indefinitely for certificate generation is against best practices.28d