CVE-2025-0836: Milestone Systems Xprotect Vms

Medium severity, CVSS 6.3. EPSS: 0.2% chance of exploitation in the next 30 days.

Missing Authorization vulnerability in Milestone Systems XProtect VMS allows users with read-only access to Management Server to have full read/write access to MIP Webhooks API.

Affected products

• Milestone Systems Xprotect Vms: from 23.1, before 23.1.157.1.1470 (fixed in 23.1.157.1.1470); from 23.2, before 23.2.21.1.398 (fixed in 23.2.21.1.398); from 23.3, before 23.3.72.1.466 (fixed in 23.3.72.1.466); from 24.1, before 24.1.12292.2279 (fixed in 24.1.12292.2279); from 24.2, before 24.2.14561.2270 (fixed in 24.2.14561.2270); from 25.1, before 25.1.15990.2272 (fixed in 25.1.15990.2272)

Published 2025-12-16. Last modified 2026-06-17.