Is CVE-2025-8352 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-8352 being exploited in the wild.

How severe is CVE-2025-8352?

Informational severity, published 6 October 2026.

Which products and versions are affected?

Eset PROTECT On-Prem 12.1.9.0 and earlier (Web Console 12.1.252.0), 12.0.13.0 and earlier (Web Console 12.0.289.0), 11.1.16.0 and earlier (Web Console 11.1.149.0).

Is there a fix for CVE-2025-8352?

Yes: fixed in ESET PROTECT On-Prem 12.1.11.0 (Web Console 12.1.260.0), 12.0.15.0 (Web Console 12.0.306.0), 11.1.18.0 (Web Console 11.1.159.0). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-8352 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2025-8352?

Check whether you run Eset PROTECT On-Prem at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-8352: ESET PROTECT On-Prem denial of service via unthrottled multipart requests

CVE-2025-8352 · Severity: info · Published 2026-10-06

ESET PROTECT On-Prem is a business management console for deploying and monitoring security across enterprise networks. A flaw in how it handles file uploads allows an attacker to send specially crafted requests that consume excessive CPU and RAM, causing the management console to become unavailable and potentially disrupting security management of protected systems.

Vendors: Eset.

Quick answers

Is CVE-2025-8352 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-8352 being exploited in the wild.
How severe is CVE-2025-8352?: Informational severity, published 6 October 2026.
Which products and versions are affected?: Eset PROTECT On-Prem 12.1.9.0 and earlier (Web Console 12.1.252.0), 12.0.13.0 and earlier (Web Console 12.0.289.0), 11.1.16.0 and earlier (Web Console 11.1.149.0).
Is there a fix for CVE-2025-8352?: Yes: fixed in ESET PROTECT On-Prem 12.1.11.0 (Web Console 12.1.260.0), 12.0.15.0 (Web Console 12.0.306.0), 11.1.18.0 (Web Console 11.1.159.0). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-8352 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-8352?: Check whether you run Eset PROTECT On-Prem at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: ESET PROTECT On-Prem 12.1.11.0 (Web Console 12.1.260.0), 12.0.15.0 (Web Console 12.0.306.0), 11.1.18.0 (Web Console 11.1.159.0)

Technical details

The vulnerability exists in the ESET PROTECT On-Prem Web Console's handling of multipart upload requests, which lack input size limits and throttling mechanisms. An unauthenticated network attacker can send crafted requests to upload servlets that trigger high resource consumption (CPU and RAM), resulting in denial of service. The fix involves removing vulnerable code and using Apache Tomcat's standard multipart request implementation instead.

Affected products

ESET PROTECT On-Prem 12.1.9.0 and earlier (Web Console 12.1.252.0), 12.0.13.0 and earlier (Web Console 12.0.289.0), 11.1.16.0 and earlier (Web Console 11.1.149.0)

Timeline

2025-08-22: disclosed: ESET Customer Advisory CA8854 published

References

https://support.eset.com/en/ca8854-eset-customer-advisory-denial-of-service-vulnerability-in-eset-protect-on-prem-fixed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.