CVE-2025-59094: Local Privilege Escalation in dormakaba Kaba exos 9300 System management

Published Jan 26, 2026

Updated

A local privilege escalation vulnerability has been identified in the Kaba exos 9300 System management application (d9sysdef.exe). Within this application it is possible to specify an arbitrary executable as well as the weekday and start time, when the specified executable should be run with SYSTEM privileges.

Affected Software

1 affected component

dormakaba Kaba exos 9300

Remediation

Information

Rich clients are vulnerable to insider attacks. If there is a need for protection (against insiders or people with access to the network), the rich clients must operate in a protected environment. Alternatively, the web client is suitable for most use cases.

Event History

Jan 26, 2026

CVE Published

via MITRE·10:04 AM

Data Sourced

via MITRE·10:04 AM

RemedyDescriptionWeakness

Data Sourced

via NVD·10:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2025-59094?

CVE-2025-59094 has been classified as a local privilege escalation vulnerability that can significantly impact system security.

How do I fix CVE-2025-59094?

To remediate CVE-2025-59094, it is advised to apply the latest patches released by dormakaba for the Kaba exos 9300 application.

Who is affected by CVE-2025-59094?

CVE-2025-59094 primarily affects users of the dormakaba Kaba exos 9300 System management application.

What kind of vulnerability is CVE-2025-59094?

CVE-2025-59094 is a local privilege escalation vulnerability that allows unauthorized users to execute arbitrary code.

When was CVE-2025-59094 reported?

CVE-2025-59094 was reported as part of ongoing security assessments of the dormakaba Kaba exos 9300 software.