CVE-2025-27925 is a high severity (CVSS 8.5) insecure deserialization flaw in Nintex Automation 5.6 and 5.7, fixed in 5.8. User input is deserialized without sufficient safeguards, which can allow code to run on the server. Upgrade to 5.8 or later and review the Nintex release notes.
What's affected
The record says Nintex Automation 5.6 and 5.7 before 5.8 have insecure deserialization of user input. Version 5.8 is therefore the fixed release, per the record. The release notes page the record links is Nintex's K2 Five release notes.
The vector needs low privileges (PR:L) and high attack complexity, and the scope is changed. The record gives no further technical detail. We did not find more detail on the release notes page we fetched, so read your Nintex support channel for specifics before making a patch plan.
Severity in the record: high, CVSS 8.5, vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H. Weakness classes: CWE-502 (Deserialization of untrusted data).
How to check if you're exposed
Find your installed version from Nintex Automation's administration pages, or from the product list in Windows Programs and Features on the servers that host it. Versions 5.6 and 5.7 are in the range if they are earlier than 5.8.
Then check who can sign in. The vector requires a low privileged account, so list who holds one: workflow designers, form authors and service accounts. Remove the ones you do not need.
Finally review network access to the server. A product like this normally belongs on an internal network or behind a reverse proxy with strong authentication.
What to do now
- Upgrade Nintex Automation to 5.8 or later following the vendor's upgrade guide, and test in a staging copy first.
- Review which accounts can sign in and remove unused ones, since the record says low privileges are required.
- Make sure the service accounts the product runs under have only the rights they need on the server and the database.
- Keep the product off the public internet, or put it behind a VPN or an identity-aware proxy.
- Check the Nintex support portal for any further guidance on this CVE and apply it.
- Look through logs of the application for repeated errors from deserialization or unusual process starts on the host.
Why it matters
Insecure deserialization (CWE-502) means the application reads a serialized object from data that a user supplied and reconstructs it. In many platforms the reconstruction step can invoke code defined by the data, so the safest design is to avoid deserializing untrusted input at all, or to restrict which types may be loaded.
The score is 8.5 rather than 9.8 because the attacker needs a login and the conditions are hard to meet, but the changed scope signals that a successful attack affects more than the component itself. Workflow platforms are often connected to many systems and hold credentials for them, which raises the stakes.
The record does not flag this CVE as known exploited (it is not on the CISA Known Exploited Vulnerabilities list as of the record), so treat it as a patching priority rather than an active incident, and keep watching the advisory.
Try it yourself
This demo shows how a vulnerability management view tracks a finding like this from discovery to a confirmed fix.
Click through it at your own pace, or open it full screen.
Quick check
Which Nintex Automation version fixes CVE-2025-27925?
5.8, per the record, which says versions 5.6 and 5.7 before 5.8 are affected.
Does the record say how the flaw is triggered?
No. It says only that user input is deserialized insecurely. Ask Nintex for details through your support channel.
Sources
Last reviewed: 19 October 2026.
