Quick answers
- Is CVE-2025-54603 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-54603 being exploited in the wild.
- How severe is CVE-2025-54603?
- Critical severity, with a CVSS score of 9, published 14 October 2025.
- Which products and versions are affected?
- Claroty Secure Access 3.3.0 through 4.0.2.
- Is there a fix for CVE-2025-54603?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2025-54603 attacked?
- It is attacked over the network.
- Am I affected by CVE-2025-54603?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An incorrect implementation of the OpenID Connect (OIDC) authentication flow in Claroty Secure Access versions 3.3.0 through 4.0.2 allows unauthenticated network attackers to bypass authentication controls. The vulnerability affects on-premise deployments where OIDC is configured. An attacker can exploit this flaw to create new user accounts or impersonate existing OIDC users without valid credentials. In specific OIDC configurations, the attacker can further add a compromised or newly created user to the built-in Administrators group, gaining full administrative privileges over the Secure Access application. No user interaction is required for exploitation. Fixes are available in versions 3.7 and 4.0.2 via the customer portal.
Affected products
- Claroty Secure Access 3.3.0 through 4.0.2
Timeline
- 2025-10-08: disclosed
- 2025-10-14: advisory