CVE-2025-7389: 
Progress OpenEdge vulnerability analysis and mitigation

CVE-2025-7389 is an arbitrary file read vulnerability in the AdminServer component of Progress Software's OpenEdge platform, affecting all supported platforms. Authenticated users with high privileges can leverage the AdminServer's elevated OS-level authority to read arbitrary files on the host system by misusing the setFile() and openFile() methods exposed through the RMI (Remote Method Invocation) interface. Affected versions include OpenEdge 12.2.0 through 12.2.9 and OpenEdge 12.8.0 through 12.2.18. The vulnerability was published on April 14, 2026, and carries a CVSS v4.0 base score of 8.2 (High) (GitHub Advisory, Feedly).

The root cause is classified as CWE-552 (Files or Directories Accessible to External Parties), where the AdminServer's RMI interface improperly exposes the setFile() and openFile() methods to authenticated users. These methods, when abused, allow an authenticated attacker to read arbitrary files from the host filesystem using the elevated OS-level privileges of the AdminServer process itself — privileges that far exceed what the authenticated user should normally possess. The attack vector is network-based, requires no user interaction, and has low attack complexity, though it does require high-privilege credentials to access the RMI interface. The vendor's fix removes the exploitable methods entirely, eliminating their exposure through RMI or any downstream RMI registry (GitHub Advisory, Progress Advisory).

Successful exploitation allows an authenticated attacker to read arbitrary files from the host system with the elevated privileges of the AdminServer process, posing a significant confidentiality risk. Sensitive data at risk includes configuration files, credential stores, private keys, and other confidential data accessible to the AdminServer's OS account. There is no integrity or availability impact reported; however, credential theft via file read could enable lateral movement or privilege escalation within the broader environment (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Feedly). The EPSS score is approximately 0.039–0.055%, placing it in the 18th percentile for exploitation likelihood within 30 days (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access with high privileges to the RMI interface, which limits the attacker pool but does not eliminate risk in environments with shared or compromised admin credentials.

1. Reconnaissance: Identify OpenEdge AdminServer instances exposed on the network, particularly those with RMI ports accessible (default RMI registry port is typically 9090 or similar). Use network scanning tools such as Nmap to identify open RMI ports.
2. Obtain credentials: Acquire valid high-privilege AdminServer credentials through phishing, credential reuse, or insider access — exploitation requires authenticated access.
3. Connect to RMI interface: Use an RMI client (e.g., a custom Java client or tools like rmiclient) to connect to the AdminServer's RMI registry endpoint.
4. Invoke vulnerable methods: Call the exposed setFile() method to specify a target file path on the host filesystem (e.g., /etc/passwd, application configuration files, or credential stores), then invoke openFile() to read the file contents using the AdminServer's elevated OS privileges.
5. Exfiltrate data: Retrieve the file contents returned by the RMI call, potentially exposing credentials, private keys, or sensitive configuration data that can be used for further lateral movement (GitHub Advisory, Progress Advisory).

• Network: Unusual or unexpected RMI connections to the OpenEdge AdminServer port from non-administrative hosts; high-frequency RMI calls from a single source IP.
• Logs: AdminServer logs showing repeated invocations of setFile() or openFile() methods, especially targeting sensitive file paths (e.g., /etc/passwd, *.properties, *.conf, *.key); authentication events for admin accounts at unusual times.
• File System: Evidence of access to sensitive files (e.g., OS audit logs showing reads of credential or configuration files by the AdminServer process) outside of normal operational patterns.
• Process: The AdminServer process accessing files outside its expected working directories, particularly system files or application secrets not normally required for its operation (GitHub Advisory).

Progress Software has released patches that remove the exploitable setFile() and openFile() methods from the RMI interface, eliminating the attack surface entirely. Organizations should apply the available patches to all affected OpenEdge installations (versions 12.2.0–12.2.9 and 12.8.0–12.2.18) immediately (Progress Advisory). As interim mitigations, restrict network access to the AdminServer RMI interface to only authorized administrator hosts using firewall rules or network segmentation, enforce strong authentication controls for AdminServer access, and monitor RMI traffic for anomalous file access patterns.

Coverage of CVE-2025-7389 has been limited to vulnerability tracking platforms and automated feeds, with no notable researcher commentary or significant media coverage identified at this time. The vulnerability was noted on Bluesky via automated CVE tracking accounts shortly after disclosure (Feedly). A brief technical write-up was published by Infinit Security (Infinit Security).