CVE-2025-62348: RCE in Salt Automation System

An attacker exploiting CVE-2025-62348 can achieve remote code execution on systems running vulnerable versions of Salt. This is a critical risk because it allows an attacker to gain complete control over the affected system, potentially leading to data breaches, system compromise, and lateral movement within the network. The attack involves crafting a malicious YAML payload that, when processed by the junos module, triggers the unintended code execution. The blast radius extends to any system where the vulnerable Salt module is utilized and exposed to untrusted input. This vulnerability shares similarities with other YAML deserialization vulnerabilities where malicious payloads can be injected to execute arbitrary commands.

1. Reserved2025-10-10
2. Published2026-01-30
3. Modified2026-02-26
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-62348 is to upgrade Salt to version 3007.9 or later, which contains the fix. If an immediate upgrade is not feasible, consider isolating systems running vulnerable Salt versions to limit potential exposure. While a direct workaround is not available, carefully scrutinize any YAML input processed by the junos module, and consider implementing input validation to prevent malicious payloads. Monitor Salt logs for unusual activity or errors related to YAML processing. After upgrading, confirm the fix by attempting to execute a junos module with a known malicious YAML payload – it should fail to execute without error.