CVE-2025-10226

The problem results from Axxon One software's dependency on an outdated PostgreSQL component in the v10.x branch (CWE-1395 — Dependency on Vulnerable Third-Party Component). This version of PostgreSQL contains numerous known vulnerabilities that were fixed only in PostgreSQL 17.4. The database backend is accessible over the network, allowing a remote attacker to directly exploit these vulnerabilities without requiring credentials or user interaction.

An attacker can obtain privilege escalation, execute arbitrary code (RCE) on the target system, or cause a denial of service (DoS). The vulnerability affects the confidentiality, integrity, and availability of the system.

AxxonSoft Axxon One must be updated to a version containing PostgreSQL 17.4 or newer. Detailed information about available patches should be checked in the vendor references at: https://www.axxonsoft.com/legal/axxonsoft-vulnerability-disclosure-policy/security-advisories. Until the update is applied, it is recommended to restrict network access to the PostgreSQL port only to trusted hosts using a firewall.

AxxonSoft Axxon One (C-Werk) version 2.0.8 and earlier, running on Windows and Linux systems with embedded PostgreSQL v10.x backend.