NVD disclosure day

Published threat advisories for October 26, 2025

CVE-2025-12285

BLU-IC2 and BLU-IC4 Missing Initial Password Change Vulnerability.

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

A critical vulnerability exists in Azure access control devices, allowing unauthenticated network access and administrative control due to a missing initial password change. This could lead to unauthorized access and potential compromise of sensitive system and user data. Verifying the impact on deployed systems is cru

NVD modified: NVD date unavailable

CVE advisoryCRITICAL

CVE-2025-12275

BLU-IC Access Control Mail Configuration Manipulation and Command Execution

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

A critical vulnerability in Azure-Access BLU-IC devices allows unauthenticated remote attackers to manipulate mail configuration files, potentially leading to command execution. This could grant unauthorized access and control over the affected systems, which are used for access control and identity management, making

NVD modified: NVD date unavailable