Is CVE-2025-10228 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-10228 being exploited in the wild.

How severe is CVE-2025-10228?

High severity, with a CVSS score of 8.8, published 14 October 2025.

Which products and versions are affected?

Rolantis Information Technologies Agentis before 4.44.

Is there a fix for CVE-2025-10228?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-10228 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2025-10228?

Check whether you run Rolantis Information Technologies Agentis at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-10228: Rolantis Agentis session fixation in Agentis platform

CVE-2025-10228 · Severity: high · CVSS 8.8 · Published 2025-10-14

A session fixation vulnerability has been identified in Rolantis Agentis, a software platform used for business information management. This flaw allows an attacker to pre-determine a user's session ID, effectively hijacking their account once they log in. If exploited, an attacker could gain full access to a user's account, potentially leading to the theft of sensitive corporate data or unauthorized administrative actions.

Technologies: Rolantis Information Technologies Agentis. Vendors: Rolantis Information Technologies.

Quick answers

Is CVE-2025-10228 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-10228 being exploited in the wild.
How severe is CVE-2025-10228?: High severity, with a CVSS score of 8.8, published 14 October 2025.
Which products and versions are affected?: Rolantis Information Technologies Agentis before 4.44.
Is there a fix for CVE-2025-10228?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-10228 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-10228?: Check whether you run Rolantis Information Technologies Agentis at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A session fixation vulnerability (CWE-384) exists in Rolantis Information Technologies Agentis versions prior to 4.44. The application fails to invalidate or renew the session identifier upon a successful user login, allowing an attacker to supply a known session ID to a victim. If the victim authenticates using that ID, the attacker can hijack the authenticated session. This attack is delivered over the network and requires minimal user interaction (UI:R), potentially resulting in a full compromise of confidentiality, integrity, and availability. Users are advised to upgrade to version 4.44 or later to resolve the issue.

Affected products

Rolantis Information Technologies Agentis before 4.44

Timeline

2025-10-14: disclosed: Initial publication of CVE-2025-10228
2025-10-14: advisory: Advisory released by USOM (TR-CERT)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.