AxxonSoft has 11 CVEs on record between 2025 and 2026. 5 were published in the last 90 days. The busiest recent month was November 2026 with 5. The median CVSS is 5.5 (medium), with 1 rated critical. None have a confirmed exploitation report. Most affected products: axxon_one (6), Axxon One (3), AxxonNet (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.5
- Publish → KEV
- —
- Last 90 days
- 5 prev 0
Weakness classes
Products
- axxon_one 6
- Axxon One 3
- AxxonNet 1
- AxxonNet ARP Agent 1
Worst active — by depth score
CVE-2025-10220Critical· 9.8Use of Unmaintained Third Party Components (CWE-1104) in the NuGet dependency components in AxxonSoft Axxon One VMS 2.0.0 through 2.0.4 on Windows allows a remote attacker to execute arbitrary code or bypass security features via exploit…54CVE-2026-121022High· 8.1Default Administrator Password Change Not Enforced in Axxon One Web Client45CVE-2025-10225High· 7.5Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) in the OpenSSL-based session module in AxxonSoft Axxon One (C-Werk) 2.0.6 and earlier on Windows allows a remote attacker under high load conditions to cau…41CVE-2026-121024Medium· 5.4Read-Only Shared Token Allows Modification of Monitoring Alerts in AxxonNet30CVE-2026-121023Medium· 5.5LDAP Bind Password Exposure in AxxonNet ARP Agent Logs30
AxxonSoft vulnerabilities
CVEs affecting AxxonSoft, newest first. Open any entry for full detail, references, and exploit status.
11 CVEsRSS
CVE-2026-121024Medium· 5.4Read-Only Shared Token Allows Modification of Monitoring Alerts in AxxonNet
Incorrect Authorization (CWE-863) in the Health Monitoring service in AxxonSoft AxxonNet before 3.28.0 on Linux allows a remote attacker in possession of a shared report token, which is intended for read-only access, to create, modify or…
CVE-2026-121023Medium· 5.5LDAP Bind Password Exposure in AxxonNet ARP Agent Logs
Insertion of Sensitive Information into Log File (CWE-532) in the ARP Agent component in AxxonSoft AxxonNet before 3.25.0 on Windows and Linux allows a local attacker with read access to ARP Agent log files or support packages to obtain …
CVE-2026-121022High· 8.1Default Administrator Password Change Not Enforced in Axxon One Web Client
Use of Default Password (CWE-1393) in the web client in AxxonSoft Axxon One before 3.0.0 on Windows and Linux allows a remote unauthenticated attacker to log in as the built-in administrator with the default credentials on a newly instal…
CVE-2026-121021Medium· 5.5Plaintext Storage of LDAP Password in Axxon One Shared Configuration
Plaintext Storage of a Password (CWE-256) in the SecurityManager shared configuration in AxxonSoft Axxon One before 3.1.0 on Windows and Linux allows a local attacker with read access to the configuration directory or to configuration ba…
CVE-2026-121020Medium· 4.3User and Role Enumeration by Low-Privileged Users in Axxon One Security Configuration API
Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) in the security configuration API in AxxonSoft Axxon One before 3.2.0 on Windows and Linux allows a remote authenticated user with limited privileges to enumerate all u…
CVE-2025-10227Medium· 4.6Missing Encryption of Sensitive Data (CWE-311) in the Object Archive component in AxxonSoft Axxon One (C-Werk) before 2.0.8 on Windows and Linux allows a local attacker with access to exported storage or stolen physical drives to extrac…
Missing Encryption of Sensitive Data (CWE-311) in the Object Archive component in AxxonSoft Axxon One (C-Werk) before 2.0.8 on Windows and Linux allows a local attacker with access to exported storage or stolen physical drives to extrac…
CVE-2025-10225High· 7.5Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) in the OpenSSL-based session module in AxxonSoft Axxon One (C-Werk) 2.0.6 and earlier on Windows allows a remote attacker under high load conditions to cau…
Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) in the OpenSSL-based session module in AxxonSoft Axxon One (C-Werk) 2.0.6 and earlier on Windows allows a remote attacker under high load conditions to cau…
CVE-2025-10223Medium· 5.4Insufficient Session Expiration (CWE-613) in the Web Admin Panel in AxxonSoft Axxon One (C-Werk) prior to 2.0.3 on Windows allows a local or remote authenticated attacker to retain access with removed privileges via continued use of an u…
Insufficient Session Expiration (CWE-613) in the Web Admin Panel in AxxonSoft Axxon One (C-Werk) prior to 2.0.3 on Windows allows a local or remote authenticated attacker to retain access with removed privileges via continued use of an u…
CVE-2025-10222Low· 3.3Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) in the diagnostic dump component in AxxonSoft Axxon One VMS (C-Werk) 2.0.0 through 2.0.1 on Windows allows a local attacker to obtain licensing-related information such…
Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) in the diagnostic dump component in AxxonSoft Axxon One VMS (C-Werk) 2.0.0 through 2.0.1 on Windows allows a local attacker to obtain licensing-related information such…
CVE-2025-10221Medium· 5.5Insertion of Sensitive Information into Log File (CWE-532) in the ARP Agent component in AxxonSoft Axxon One / AxxonNet / C-WerkNet 2.0.4 and earlier on Windows platforms allows a local attacker to obtain plaintext credentials via readin…
Insertion of Sensitive Information into Log File (CWE-532) in the ARP Agent component in AxxonSoft Axxon One / AxxonNet / C-WerkNet 2.0.4 and earlier on Windows platforms allows a local attacker to obtain plaintext credentials via readin…
CVE-2025-10220Critical· 9.8Use of Unmaintained Third Party Components (CWE-1104) in the NuGet dependency components in AxxonSoft Axxon One VMS 2.0.0 through 2.0.4 on Windows allows a remote attacker to execute arbitrary code or bypass security features via exploit…
Use of Unmaintained Third Party Components (CWE-1104) in the NuGet dependency components in AxxonSoft Axxon One VMS 2.0.0 through 2.0.4 on Windows allows a remote attacker to execute arbitrary code or bypass security features via exploit…