CVE-2025-8558 Auth bypass in Insider Threat Management (ITM) Server
Unauthenticated adjacent network users can unregister agents when license limits are exceeded, causing loss of event data and availability.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-8558?
CVE-2025-8558 is a low-severity authentication bypass vulnerability in Proofpoint Insider Threat Management (ITM) Server, published on 3 Nov 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Insider Threat Management (ITM) Server versions prior to 7.17.2 contain an authentication bypass vulnerability that allows unauthenticated users on an adjacent network to perform agent unregistration when the number of registered agents exceeds the licensed limit. Successful exploitation prevents the server from receiving new events from affected agents, resulting in a partial loss of integrity and availability with no impact to confidentiality.
Weakness: CWE-306
Which versions are affected by CVE-2025-8558?
It affects 1 product.
Products include Proofpoint Insider Threat Management Server.
How do I fix CVE-2025-8558?
No fix has been published for CVE-2025-8558 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-8558 being exploited?
There is no known exploitation of CVE-2025-8558 in the wild and no public exploit code.
Other vulnerabilities in Proofpoint Insider Threat Management (ITM) Server
Sources
Also known as GHSA-5mj6-fm92-ww5m.