CVE-2025-48928

CVE-2025-48928 is an information-disclosure flaw (CWE-528/CWE-552) in the TeleMessage TM SGNL service, marketed by Smarsh, as the service existed through 2025-05-05: its JSP application generates heap content roughly equivalent to a core dump, and any password previously sent to the service over HTTP remains in that dump. If heap or core dump files from the application become accessible to unauthorized parties, the attacker can read those retained passwords and other sensitive heap data. The flaw affects users and credentials whose traffic was processed by the TeleMessage TM SGNL service before May 5, 2025. It was exploited in the wild in May 2025, and CISA added it to the Known Exploited Vulnerabilities catalog on 2025-07-01; EPSS currently puts the 30-day exploitation probability at 0.6%.

What to do: If your organization uses TeleMessage TM SGNL, apply mitigations per Smarsh/TeleMessage vendor instructions or discontinue use of the service, following CISA BOD 22-01 cloud-service guidance as required by the KEV catalog entry. Rotate any credentials that were transmitted to the TeleMessage service over HTTP before 2025-05-05, since they may have been captured in heap dumps. No fixed release version is given in the available data, so confirm remediation status directly with the vendor.