Insider Threat and DLP
CVE-2025-8558: Insider Threat Management (ITM) Server versions prior to 7.17.2 contain an authentication bypass in Insider Threat Management (ITM) Server
Insider Threat Management (ITM) Server versions prior to 7.17.2 contain an authentication bypass vulnerability that allows unauthenticated users on an adjacent network to perform agent unregistration when the number of registered agents exceeds the licensed limit.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Insider Threat Management (ITM) Server 0 | 7.17.2 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
Insider Threat Management (ITM) Server versions prior to 7.17.2 contain an authentication bypass vulnerability that allows unauthenticated users on an adjacent network to perform agent unregistration when the number of registered agents exceeds the licensed limit. Successful exploitation prevents the server from receiving new events from affected agents, resulting in a partial loss of integrity and availability with no impact to confidentiality.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 11 Oct 2026.