CVE-2025-27258 is a Critical (CVSS 9.8) improper access control flaw in Ericsson Network Manager (ENM) versions before ENM 25.1 GA, which can lead to privilege escalation. Ericsson's October 2025 bulletin has the details, so read it and upgrade. Confirm your release with Ericsson.
What's affected
Affected, per the record: Ericsson Network Manager versions prior to ENM 25.1 GA. The fix is ENM 25.1 GA or later.
The record gives few details: the product contains a vulnerability that, if exploited, can result in an escalation of privilege. Ericsson's security bulletin for October 2025 is the vendor source. I could not read the page text in my fetch, so confirm the exact fixed releases, any patch levels and the upgrade path in the bulletin or through your Ericsson support contact.
ENM is telecom network management software, usually run by operators and their partners, and typically upgraded through a managed process with the vendor.
How to check if you're exposed
Check the ENM release you run from the platform's version information or from your vendor managed inventory. Anything before ENM 25.1 GA is in scope.
Because this is a managed telecom platform, the useful steps are mostly organisational. Ask your Ericsson contact for confirmation of your release and the patch path, and ask how the system can be reached from other networks.
On the network side, check the exposure of the management interfaces. Management planes for network equipment should not be reachable from general corporate or internet networks:
nmap -Pn -p 443,8443 your-enm-host
Run a check like that only from a host and against systems you are authorised to test. Review administrative accounts and recent privilege changes in the product's audit log.
What to do now
- Confirm your ENM release and whether it is before ENM 25.1 GA.
- Read the Ericsson PSIRT security bulletin for October 2025.
- Plan the upgrade with your Ericsson support team, and apply any interim patches they supply.
- Limit network access to the management interfaces to a small set of administrator hosts.
- Review privileged accounts and role assignments, and remove what is not needed.
- Check the audit log for unexpected privilege changes.
Why it matters
The record lists CWE-284: improper access control. The product does not correctly restrict what a user or process may do, so a caller can gain rights they were not given. The vendor text confirms an escalation of privilege, with no further technical detail.
The vector is network based, low complexity, no privileges and no user interaction, with high impact on all three areas. Management systems for telecom networks control equipment that carries real traffic, which is why a privilege flaw in them deserves quick attention. The record does not say the flaw is used in attacks. The record's KEV flag is false, so it is not in the CISA Known Exploited Vulnerabilities catalog.
With vendor managed platforms, response speed depends on your contract and your contacts. Know who to call before you need to.
Quick check
Is there a published workaround?
The record gives none. Limit network access to management interfaces and follow the vendor bulletin.
Which version fixes it?
ENM 25.1 GA or later, since affected versions are those prior to ENM 25.1 GA. Confirm patch details in Ericsson's bulletin.
Sources
Last reviewed: 19 October 2026.
