CVE-2025-2244 is a critical (CVSS 9.8) insecure PHP deserialization flaw in the Bitdefender GravityZone Console. A crafted serialized object can lead to a file write and command execution on the host. Bitdefender says an automatic update to version 6.41.2-1 fixes the issue.
What's affected
Bitdefender's advisory VA-12634, published on 4 April 2025, names the GravityZone Console as the affected product. The weak code is the sendMailFromRemoteSource method in Emails.php, which calls PHP unserialize() on user-supplied input without validation.
The advisory does not list a first affected version. It states that an automatic update to 6.41.2-1 fixes the issue, so treat any console below that version as needing the update. The NVD score is 9.8 under CVSS 3.1 with no privileges and no user interaction needed. Bitdefender's own advisory scores it 9.5 under CVSS 4.0.
How to check if you're exposed
Check the console version in the GravityZone management interface and compare it with 6.41.2-1. If your console is cloud hosted, Bitdefender's wording suggests the update is applied automatically, but confirm that the console is on the fixed build rather than assume it.
For an on-premises appliance, check that automatic updates are enabled and that the appliance can reach Bitdefender update servers. Also check that the console is not exposed more widely than it needs to be, since the flaw is reachable over the network.
Reading an inventory is faster than checking host by host. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan and a Gold directory you can search for any CVE. Reachability analysis helps you see whether a vulnerable component is actually used in your code, so you can fix the exposed ones first.
What to do now
- Confirm the console build is 6.41.2-1 or later.
- If it is not, trigger the update through the console's update mechanism or contact Bitdefender support.
- Restrict network access to the management console to administrators and trusted networks.
- Review the host for unexpected files or processes if the console was exposed to untrusted networks before the update.
- Document the check so auditors can see the version and date.
Why it matters
CWE-502 is deserialization of untrusted data. PHP's unserialize() rebuilds objects from a string. If the string comes from a user, the user chooses which classes are created and which of their methods run during cleanup. Chains of such classes can write files or run commands, which matches the impact the advisory describes.
The standard defense is never to unserialize input you do not control. Safer formats such as JSON carry data only, not behavior. A security management console is a high value target because it often has broad reach across endpoints, which is why a flaw here deserves quick action. The record does not flag it as exploited and the KEV flag is false. The advisory credits the researcher Nicolas Verdier.
Quick check
What version fixes CVE-2025-2244?
Bitdefender says an automatic update to GravityZone Console version 6.41.2-1 fixes the issue.
Does the attacker need an account?
The CVSS 3.1 vector shows no privileges required and no user interaction, so the flaw is reachable over the network without a login.
Sources
Last reviewed: 19 October 2026.
