VulnSocial

CVE-2025-0289Active Exploitation(paragon-software / paragon_backup_\&_recovery)

MEDIUMCVSS 7.8 · HIGH

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

  • Prioritize remediation for paragon-software paragon_backup_\&_recovery systems immediately
  • Assume compromise if assets are exposed
  • Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

Various Paragon Software products contain an insecure kernel resource access vulnerability facilitated by the driver not validating the MappedSystemVa pointer before passing it to HalReturnToFirmware, which can allows an attacker the ability to compromise the service.

paragon-software CVEsBack to dashboard
4.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Other references

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • paragon_backup_\&_recovery
  • paragon_disk_wiper
  • paragon_drive_copy
  • paragon_hard_disk_manager

Threat summary

  • Active exploitation appears in 1 classified signals
  • 1 mentions across 1 observed day

What's happening

  • Active exploitation reported across 1 signal
  • 1 total mentions across 1 day

Affected systems

Vendors
paragon-software
Products
paragon_backup_\&_recoveryparagon_disk_wiperparagon_drive_copyparagon_hard_disk_managerparagon_migrate_os_to_ssdparagon_partition_manager

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-04-14: 1Active Exploitation · 2026-04-14: 104-14
Signal classification1 categories
Active Exploitation
1100.0%
Referenced assets1 URL
By indicator
Full discourse1 post
  • CTIWatch@ctiwatchcloud
    Active Exploitation

    🚨 [HIGH] Active exploitation detected: CVE-2025-0289 Exploit in the wild confirmed for CVE-2025-0289 (CVSS null). Various Paragon Software products contain an insecure kernel resource access vulnerabilit... 🔗 http://ctiwatch.cloud/alerts #ZeroDay #ExploitInWild #CyberSecurity

    Post summary

    Exploit in the wild confirmed for CVE-2025-0289, an insecure kernel resource access vulnerability affecting Paragon Software products.

    00000293
    5.6K followersView on X
CPE platform detail6 entries

6 of 6 entries

PartVendorProductVersionTarget SWTarget HW
Appparagon-softwareparagon_backup_\&_recovery---
Appparagon-softwareparagon_disk_wiper---
Appparagon-softwareparagon_drive_copy---
Appparagon-softwareparagon_hard_disk_manager---
Appparagon-softwareparagon_migrate_os_to_ssd---
Appparagon-softwareparagon_partition_manager---

Explore more

Back to dashboardparagon-software CVEsparagon_backup_\&_recovery vulnerabilities