Medium 4.8Published Apr 28, 2026

CVE-2025-10539Improper TLS Certificate Validation RCE via Malicious Update in DeskTime Time Tracking App

Updated under an hour ago (Oct 26, 2026, 1:10 PM ET)

Does this affect you?

It affects DeskTime Time Tracking App and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for DeskTime Time Tracking App

Exploited in the last 30 days

Due to improper TLS certificate validation in the DeskTime Time Tracking App before version 1.3.674, attackers who can position themselves in the network path between the client and the DeskTime update servers can return a malicious executable in response to an update request. This allows the attacker to achieve user-level remote code execution on the affected client.

CVSS: 4.8 MEDIUM (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness (CWE): CWE-295, CWE-296, CWE-494
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: SEC-VLab
NVD analysis: Analyzed
Record last updated: Apr 29, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

DeskTime DeskTime Time Tracking App desktime:time_tracking_app (from the name)	before 1.3.674	CNA record
draugiemgroup desktime_time_tracking draugiemgroup:desktime_time_tracking	before 1.3.674	NVD

References

References

https://r.sec-consult.com/desktime	third-party-advisory
https://desktime.com/download	patch, product
http://seclists.org/fulldisclosure/2026/Apr/20	exploit, mailing-list, third-party-advisory
http://seclists.org/fulldisclosure/2026/Apr/21	exploit, mailing-list, third-party-advisory
https://sec-consult.com/vulnerability-lab/advisory/missing-tls-certificate-validation-leading-to-rce-in-desktime-time-tracking-app/	third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.