Is CVE-2026-44925 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44925 being exploited in the wild.

How severe is CVE-2026-44925?

Informational severity, published 20 May 2026.

Which products and versions are affected?

Veritas InfoScale Operations Manager 9.1.3.

Is there a fix for CVE-2026-44925?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-44925 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-44925?

Check whether you run Veritas InfoScale Operations Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44925: Veritas InfoScale Operations Manager CSRF in VIOM web application

CVE-2026-44925 · Severity: info · Published 2026-05-20

Veritas InfoScale Operations Manager (VIOM), a tool used for managing complex storage and server environments, is vulnerable to an attack that can trick administrators into performing unintended actions. By convincing a logged-in user to click a malicious link, an attacker can modify settings or configurations within the management console without the user's consent. This could lead to unauthorized changes in the infrastructure management platform.

Technologies: Veritas InfoScale Operations Manager. Vendors: Veritas.

Quick answers

Is CVE-2026-44925 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44925 being exploited in the wild.
How severe is CVE-2026-44925?: Informational severity, published 20 May 2026.
Which products and versions are affected?: Veritas InfoScale Operations Manager 9.1.3.
Is there a fix for CVE-2026-44925?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-44925 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-44925?: Check whether you run Veritas InfoScale Operations Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in the web interface of Veritas InfoScale Operations Manager (VIOM) version 9.1.3. The application fails to properly validate that requests are intentionally initiated by the authenticated user, likely due to missing or insufficient anti-CSRF tokens. An attacker can exploit this by hosting a malicious HTML page or link that, when visited by a user with an active VIOM session, submits unauthorized requests to the VIOM server. This can result in unauthorized configuration changes or state modifications within the management console. The attack requires network reachability to the victim and successful social engineering to induce the user to click the link.

Affected products

Veritas InfoScale Operations Manager (VIOM) 9.1.3

Timeline

2026-05-20: disclosed
2026-05-20: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.