Triofox versions prior to 16.7.10368.56560, are vulnerable to an Improper Access Control flaw that allows access to initial setup pages eve…

cisa required action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

1. 2025-11-10 Published
2. 2025-11-11 CISA SSVC: exploitation active
3. 2025-11-12 Added to CISA KEV
4. 2025-12-03 CISA patch deadline

Added

last yr. (2025-11-12)

Patch by

2025-12-03 (11mo ago)

Ransomware

Not known

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Vendor, product

Gladinet, Triofox

CISA name

Gladinet Triofox Improper Access Control Vulnerability

Exploitation

Active, exploited in the wild

Automatable

yes

Technical impact

total

Assessed

last yr. (2025-11-11)

95.75% chance of exploitation in the next 30 days, higher than 99.8% of all scored CVEs (FIRST EPSS, 2026-11-11).

• cloud.google.com https://cloud.google.com/blog/topics/threat-intelligence/triofox-vulnerability-cve-2025-12480 referenced PoC, tagged "exploit" by a source, unverified

• TrioFox TrioFox

Weakness

• CWE-284 Improper Access Control

• cloud.google.com /blog/topics/threat-intelligence/triofox-vulnerability-cve-2025-12480

  third-party-advisory, exploit

• github.com /mandiant/Vulnerability-Disclosures/blob/master/2025/MNDT-2025-0008.md

  third-party-advisory

• triofox.com /

  product

• access.triofox.com /releases_history/

  release-notes

• cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-12480

  government-resource, us-government-resource

• CVE List CVE-2025-12480
• NVD CVE-2025-12480

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.