CVE-2025-35042

CRITICAL 9.8CVE-2025-35042 · Published 22/09/2025 · updated 17/06/2026

In short

CVE-2025-35042 is a CRITICAL (CVSS 9.8) vulnerability affecting acropolis (airship.ai).
Chance of exploitation in the next 30 days (EPSS): 0.43%, higher than 37.5% of all vulnerabilities.
Fix: update to 11.0.21, 11.1.9, 10.2.35 or later.

Package	Affected versions	Patched versions
acropolis airship.ai	`≥ 11.0.0, < 11.0.21≥ 11.1.0, < 11.1.9< 10.2.35`	`11.0.2111.1.910.2.35`

Description

Airship AI Acropolis includes a default administrative account that uses the same credentials on every installation. Instances of Airship AI that do not change this account password are vulnerable to a remote attacker logging in and gaining the privileges of this account. Fixed in 10.2.35, 11.0.21, and 11.1.9.

References

raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-265-01.json · Third Party Advisory
cve.org/CVERecord · Third Party Advisory

More vulnerabilities in acropolis

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free