Progress Patches Remote Command Execution Flaw in OpenEdge AdminServer (CVE-2025-7388)

Progress Software has issued patches for a high-severity OpenEdge AdminServer flaw tracked as CVE-2025-7388 (CVSS 8.4), which enables Remote Command Execution (RCE) via the Java RMI interface in OpenEdge LTS releases 12.2.17, 12.8.8, and earlier versions. The vulnerability stems from insecure Java RMI usage, with AdminServer often running with elevated privileges, meaning exposed RMI stubs could trigger downstream logic not fully controlled by the OS.

According to Progress, the issue allowed RCE through the workDir parameter passed as the –w jvmStart argument, with quoted strings not sanitised and quotes could be manipulated to inject OS commands. The affected versions are OpenEdge 12.2.17 and earlier, 12.8.8 and earlier, while fixes arrive in OpenEdge LTS Update 12.2.18 and 12.8.9, featuring input sanitisation and RMI hardening by disabling remote RMI by default.

Progress strongly advises upgrading and notes that parameter value sanitisation neutralises the attack risk and that remote RMI should be disabled when remote access is not required; for those unable to patch immediately, they recommend disabling Remote RMI, restricting access, running AdminServer with least privilege, and enabling the JVM Security Manager.