CVE-2025-14046: enterprise server before 3.14.21 (exclusive), from 3.15.0 (inclusive), before 3.15.16 (exclusive), from 3.16.0…

Affected technology

enterprise server · before 3.14.21 (exclusive)
github

enterprise server · from 3.15.0 (inclusive), before 3.15.16 (exclusive)
github

enterprise server · from 3.16.0 (inclusive), before 3.16.12 (exclusive)
github

enterprise server · from 3.17.0 (inclusive), before 3.17.9 (exclusive)
github

enterprise server · from 3.18.0 (inclusive), before 3.18.3 (exclusive)
github

Enterprise Server · 3.18.0 through 3.18.2; status changes: 3.18.3 — unaffected, 3.17.0 through 3.17.8; status changes: 3.17.9 — unaffected, 3.16.0 through 3.16.11; status changes: 3.16.12 — unaffected, 3.15.0 through 3.15.15; status changes: 3.15.16 — unaffected, 3.14.0 through 3.14.20; status changes: 3.14.21 — unaffected
GitHub

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · Passive user interaction

What an attacker can do

Vendor/CNA’s CVSS 4.0 assessment (base score 8.6/10) rates confidentiality and integrity impact as high; availability impact as none. The description does not specify what an attacker can achieve beyond these rated impacts.