CVE-2025-59094 HIGH

CVE-2025-59094: Local Privilege Escalation in dormakaba Kaba exos 9300 System management

Vendor Dormakaba
Product Kaba exos 9300
Weakness CWE-269
Published January 26, 2026
Last update January 26, 2026
View on NVD All CVEs

CVSS base score

8.4/10
Attack vector Local
Attack complexity Low
Privileges required High
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

A local privilege escalation vulnerability has been identified in the Kaba exos 9300 System management application (d9sysdef.exe). Within this application it is possible to specify an arbitrary executable as well as the weekday and start time, when the specified executable should be run with SYSTEM privileges.

Key dates

02Disclosure timeline

January 26, 2026 CVE published
January 26, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-8719 AI Engine 3.4.9 - Authenticated (Subscriber+) Privilege Escalation via Missing Authorization in MCP OAuth Bearer Token CVE-2026-8980 Privilege Escalation CVE-2026-46424 Budibase: Missing Cache Invalidation on Public API Role Unassignment Allows Revoked Users to Retain Privileges for Up to 1 Hour CVE-2026-7465 Spectra Gutenberg Blocks <= 2.19.25 - Authenticated (Contributor+) Remote Code Execution via Arbitrary PHP Function Call via Block Attributes CVE-2026-49189 Broadcast Receiver Privilege Escalation