Medium severity6.3NVD Advisory· Published Dec 16, 2025· Updated Apr 15, 2026

CVE-2025-0836

Description

Missing Authorization vulnerability in Milestone Systems XProtect VMS allows users with read-only access to Management Server to have full read/write access to MIP Webhooks API.

Affected products

Milestone Systems/XProtect VMSllm-create

Patches

Vulnerability mechanics

References

supportcommunity.milestonesys.com/s/article/CVE-2025-0836-XProtect-MIP-API-broken-access-controlnvd
supportcommunity.milestonesys.com/s/article/XProtect-VMS-cumulative-patches-complete-listnvd

News mentions

No linked articles in our index yet.

cvss	0.410
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000