Is CVE-2025-27920 (Srimax Output Messenger Directory Traversal) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2025-27920 to its Known Exploited Vulnerabilities catalogue on 19 May 2025, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Srimax Output Messenger contains a directory traversal vulnerability that allows an attacker to access sensitive files outside the intended directory, potentially leading to configuration leakage or arbitrary file access.

What the KEV listing tells you about exploitation status

The practical signal is the KEV listing itself. CISA adds a CVE to the Known Exploited Vulnerabilities catalogue only when it has reliable evidence of active exploitation, so this is not a theoretical or "may be abused" finding. For responders, that changes the question from whether exploitation is possible to whether the affected environment has already been exposed and needs immediate triage.

For a directory traversal issue, the first job is to determine whether the vulnerable messenger service is reachable from any untrusted network path and whether the product is deployed in a way that exposes local configuration or file-system content. That exposure can turn a single read primitive into broader environment intelligence, especially when configuration files, credentials, or application metadata sit alongside the target path.

A good starting point is to treat the KEV entry as an operational priority signal, not just a vulnerability record. Use the CISA Known Exploited Vulnerabilities Catalog to confirm the current remediation deadline and the vendor advisory for the exact fix path, then verify whether your exposure matches the conditions that make traversal exploitable in your deployment.

Why directory traversal matters beyond simple file reads

Directory traversal is dangerous because the attacker is not trying to "break in" in the classic sense, they are trying to move the application outside its intended file boundary. Once that boundary is crossed, the most likely consequence is disclosure of sensitive files, but the real risk is what those files reveal about the rest of the environment: paths, usernames, service configuration, tokens, internal endpoints, or other data that supports follow-on access.

That is why the impact can be larger than the vulnerability description suggests. A seemingly narrow file-read flaw can become an enabler for secondary compromise if leaked configuration contains credentials or trust material that is reused elsewhere. In practice, the breach path often shifts from information disclosure to account abuse, service impersonation, or privilege escalation after the initial file access.

Directory traversal also tends to be easy to weaponise at scale because it requires little attacker sophistication once a reachable endpoint is identified. If the vulnerable component is internet-facing, the most important question is not whether the flaw is interesting, but whether any sensitive files are accessible without needing an authenticated session or additional user interaction.

How to respond when patching is delayed

If you cannot patch immediately, reduce exposure first. Place the system behind access controls, limit who can reach the affected interface, and remove any unnecessary administrative or internet-facing exposure. Then verify whether the application has logging that can show suspicious path patterns, unusual file access attempts, or requests targeting configuration locations.

When traversal can expose configuration, credential rotation becomes part of the response if there is any credible chance that secrets were readable. That includes application secrets, API keys, session material, and service credentials that may have been stored in files the attacker could reach. If you find evidence of file access before remediation, assume the leaked material may already be usable and validate downstream systems for abuse.

For a deeper playbook on exploited vulnerabilities, emergency triage, and post-patch compromise assessment, Zero-Day and Exploited Vulnerabilities Guide is the most directly relevant internal reference. If you need a broader vulnerability handling workflow, the Vulnerability Management Guide helps with prioritisation, exceptions, and verification after remediation.

Risk and Threat Considerations

Directory traversal is high-risk when the target application stores readable secrets, configuration, or internal metadata in predictable locations. The threat is not only direct file disclosure, but also the attacker’s ability to use that disclosure to locate credentials, understand internal structure, or prepare a more privileged follow-on compromise.

Failure mechanism: The application fails to confine file access to the intended directory, allowing path manipulation to escape the sandbox and read files that should never be exposed to the requester.

Impact: Attackers may retrieve configuration, credentials, or other sensitive data, which can lead to broader system compromise, unauthorized access, or persistence if the exposed material is reused elsewhere.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-1 — Inventory and Control of Enterprise Assets	Exposure depends on knowing where the vulnerable messenger is deployed.
Recommendation — Identify every installed instance and isolate any internet-facing deployment.
NIST SP 800-53 Rev 5	RA-5 — Vulnerability Monitoring and Scanning	KEV status makes exposure triage and verification a vulnerability-management task.
	SC-7 — Boundary Protection	Traversal risk increases when untrusted traffic can reach the vulnerable file-access path.
	SI-2 — Flaw Remediation	Active exploitation requires prompt patching or mitigation of the underlying flaw.
Recommendation — Prioritise the CVE for assessment and remediation using current exploit intelligence. Restrict access paths so only required sources can reach the affected service. Apply the vendor fix or mitigation as soon as operationally possible.
OWASP ASVS	V5 — File Handling	Directory traversal is a file-handling weakness that breaks path confinement.
Recommendation — Validate and normalise file paths so requests cannot escape the intended directory.

Practitioner Guidance

What to prioritise: Treat public-facing instances first, then any deployment where the product can reach local configuration, shared storage, or backup paths. Those are the environments where traversal becomes materially useful to an attacker.

What to verify: Confirm whether the system logs attempted parent-directory references, abnormal path encodings, or requests for configuration locations. If the logs are thin, assume you need compensating evidence from adjacent systems such as reverse proxies, WAF logs, or host telemetry.

Decision rule: If you cannot prove that no sensitive files were accessible, rotate exposed secrets and review dependent services before declaring the issue contained. If patching is delayed, reduce reachability immediately rather than waiting for a perfect forensic picture.

Practitioner takeaway: With an actively exploited traversal flaw, the key question is not just "can it read files?" but "what usable trust material might those files expose?"

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org