Unified PAM vulnerabilities

3 known vulnerabilities in Unified PAM from Securden. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.2 High severity

  Unified PAM: Use of Weak Credentials

  CVE-2025-6737Aug 25, 2025Securden

  Securden’s Unified PAM Remote Vendor Gateway access portal shares infrastructure and access tokens across multiple tenants. A malicious actor can obtain authentication material and access the gateway server with low-privilege permissions.

• 9.4 Critical severity

  Unified PAM: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2025-53120Aug 25, 2025SecurdenEPSS 11.7%

  A path traversal vulnerability in unauthenticated upload functionality allows a malicious actor to upload binaries and scripts to the server’s configuration and web root directories, achieving remote code execution on the Unified PAM server.

• 9.8 Critical severity

  Unified PAM: Missing Authentication for Critical Functionality

  CVE-2025-53118Aug 25, 2025SecurdenEPSS 35.1%

  An authentication bypass vulnerability exists which allows an unauthenticated attacker to control administrator backup functions, leading to compromise of passwords, secrets, and application session tokens stored by the Unified PAM.