Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.1

Adobe Acrobat Reports: Malicious Report Injection Possible

CVE-2025-40900 · published 5 months ago
Summary

Adobe Acrobat's Reports feature can be exploited by a malicious user to inject malicious code into a victim's system. This can lead to unauthorized data modification or disruption of the application. To mitigate this risk, ensure that all report templates are thoroughly validated and that users are educated on the potential risks of importing unknown report templates.

What to do
  • Update nozomi networks guardian to version 26.1.0 or later.
  • Update nozomi networks cmc to version 26.1.0 or later.
  • Update nozominetworks cmc to version 26.1.0 or later.
  • Update nozominetworks guardian to version 26.1.0 or later.
Affected software
VendorProductAffected versions
nozomi networks guardian < 26.1.0
nozomi networks cmc < 26.1.0
nozominetworks cmc < 26.1.0
cpe:2.3:a:nozominetworks:cmc:*:*:*:*:*:*:*:*
nozominetworks guardian < 26.1.0
cpe:2.3:a:nozominetworks:guardian:*:*:*:*:*:*:*:*
Original advisory text
Angular template injection in Reports in Guardian/CMC before 26.1.0
An Angular template injection vulnerability was discovered in the Reports functionality due to improper validation of an input parameter. An authenticated user with report privileges can define a malicious report containing an Angular template payload, or a victim can be socially engineered to import a malicious report template. When the victim views or imports the report, the Angular template executes in their browser context, allowing the attacker to modify application data, or disrupt application availability. Full XSS exploitation and direct information disclosure are prevented by the existing input validation and Content Security Policy configuration.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
5.1 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-1336Improper Neutralization of Special Elements Used in a Template Engine
Timeline
Published19 May 2026
Updated29 Oct 2026
First seen19 May 2026
Sources
CVE-2025-40900 · NVD
CVE-2025-40900 · MITRE
Track software like this
Free during beta