CVE-2021-37425: Altova Mobiletogether Server

Critical severity, CVSS 9.1. EPSS: 66.3% chance of exploitation in the next 30 days.

Altova MobileTogether Server before 7.3 SP1 allows XXE attacks, such as an InfoSetChanges/Changes attack against /workflowmanagement, or reading mobiletogetherserver.cfg and then reading the certificate and private key.

Affected products

• Altova Mobiletogether Server: from 7.0, before 7.3 (fixed in 7.3); version 7.3 only

Published 2021-08-10. Last modified 2026-06-17.