CVE-2025-9588 is a critical (CVSS 10.0) OS command injection in Iron Mountain Archiving Services enVision. The record says versions before 250563 are affected. Plan to move to build 250563 or later and confirm the specifics with the vendor and the national advisory the record cites.
What's affected
The record's description reads: improper neutralization of special elements used in an OS command, in Iron Mountain Archiving Services Inc. enVision, allowing command injection. It states that enVision before 250563 is affected. That implies 250563 is the first build without the issue, but the description does not say so in those words, so confirm the fixed build with Iron Mountain.
The product list in the record also includes the Linux kernel. The record does not explain this entry, and the description names only enVision, so do not read it as a Linux kernel vulnerability.
The two references are notices from Turkish national cyber security bodies (USOM and the Siber Guvenlik Baskanligi). When I fetched them, the pages returned only the site shell with no advisory text. I could not read the vendor guidance, which is why this post stays close to the record.
The class is CWE-78, OS command injection. The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H: network reachable, low complexity, no privileges, no user interaction, and a changed scope with high impact on confidentiality, integrity and availability. That combination is what produces the maximum score of 10.0.
How to check if you're exposed
Find out whether your organisation runs enVision, and which build. The build number is the thing that matters here, because the cut off is expressed as 250563. Look in the product's about or version screen, or ask the team that administers the platform.
Then work out reachability. If the enVision web or service interface can be reached from the internet, or from networks you do not control, treat the system as high priority. From a different network, and only against hosts you own:
nmap -sV <envision-host>
The vendor's own guidance takes precedence over anything here. If you hold a support contract, the vendor contact is the fastest route to the exact steps.
What to do now
- Identify every enVision instance and its build number.
- Contact Iron Mountain support to confirm the fixed build and get the upgrade, and plan the move to 250563 or later.
- Until it is upgraded, restrict network access to the instance to the smallest set of trusted addresses.
- Review system and web logs on the host for unexpected commands or processes, and preserve evidence if you find any.
- Rotate credentials and keys stored on or reachable from the host if you suspect abuse.
Why it matters
Command injection is the case where text supplied by a requester ends up inside a command the server runs. If the text is not neutralised, it can change what the command does, and the process runs with whatever rights the service has. The changed scope in the vector reflects that the damage can extend beyond the vulnerable component itself.
A document archiving platform holds records that other systems and teams depend on, so integrity matters as much as secrecy. The record says the CVE is not in the CISA Known Exploited Vulnerabilities catalog and does not claim exploitation or a public exploit. Treat the score as a reason to patch promptly, not as a statement that attacks have been seen.
Try it yourself
This walkthrough shows how a finding like this is surfaced and triaged in a scan.
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes CVE-2025-9588?
The record says enVision before 250563 is affected. Confirm with Iron Mountain that 250563 or later is the fixed build for your deployment.
Is this a Linux kernel flaw?
No. The Linux kernel appears in the product list of the record, but the description names only enVision. Confirm the platform details with the vendor.
Sources
- USOM notice TR-25-0285, cited by the record (page text did not render when fetched)
- Siber Guvenlik Baskanligi notice TR-25-0285, cited by the record (page text did not render when fetched)
- Safeguard Gold entry: CVE-2025-9588
- CVE record fields as held in the Safeguard CVE record
Last reviewed: 18 October 2026.
