CVE-2025-9918: RCE in Google SecOps SOAR

The impact of CVE-2025-9918 is significant due to its potential for Remote Code Execution. A successful exploit allows an attacker to execute arbitrary commands on the SecOps SOAR server with the privileges of the user performing the import. This could lead to complete system compromise, including data exfiltration, modification of security configurations, and lateral movement within the network. The attacker's ability to import Use Cases is the primary prerequisite, highlighting the importance of access controls within the SecOps SOAR environment. This vulnerability shares similarities with other path traversal exploits where attackers leverage crafted input to access unauthorized files and execute malicious code.

1. Reserved2025-09-03
2. Published2025-09-11
3. EPSS updated2026-03-23

The primary mitigation for CVE-2025-9918 is to upgrade Google SecOps SOAR Server to version 6.3.54.0 or later. If upgrading immediately is not feasible, restrict access to Use Case import functionality to only authorized personnel. Implement strict input validation on all uploaded archives, specifically looking for path traversal sequences (e.g., ../). Consider using a Web Application Firewall (WAF) to filter out malicious ZIP files containing suspicious patterns. There are no specific Sigma or YARA rules available at this time, but monitoring for unusual process execution after archive imports is recommended. After upgrading, confirm the fix by attempting to import a test ZIP archive containing a known path traversal sequence; the import should fail with an appropriate error message.