Critical 9.8Published Jan 15, 2026

CVE-2025-62193NOAA PMEL Live Access Server (LAS) PyFerret command injection

Updated under an hour ago (Oct 27, 2026, 11:10 PM ET)

Does this affect you?

It affects National Oceanic and Atmospheric Administration (NOAA) Live Access Server (LAS). Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for National Oceanic and Atmospheric Administration (NOAA) Live Access Server (LAS)

Exploited in the last 30 days

Sites running NOAA PMEL Live Access Server (LAS) are vulnerable to remote code execution via specially crafted requests that include PyFerret expressions. By leveraging a SPAWN command, a remote, unauthenticated attacker can execute arbitrary OS commands. Fixed in a version of 'gov.noaa.pmel.tmap.las.filter.RequestInputFilter.java' from 2025-09-24.

CVSS: 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-78
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: cisa-cg
NVD analysis: Deferred
Record last updated: Jan 15, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

National Oceanic and Atmospheric Administration (NOAA) Live Access Server (LAS) national_oceanic_and_atmospheric_administration_noaa:live_access_server_las (from the name)	8; 8 not affected	CNA record

References

References

https://github.com/NOAA-PMEL/LAS/tree/main	product
https://github.com/NOAA-PMEL/LAS/blob/main/README.md	patch
https://www.cve.org/CVERecord?id=CVE-2025-62193	vdb-entry
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-015-01.json	third-party-advisory, government-resource
https://github.com/NOAA-PMEL/LAS/commit/de5f9237bfd4ac5085bcc49a6e30bbc9507ddb29	patch
https://github.com/NOAA-PMEL/LAS/commit/e69afb1898ae7e69f3e047513fc1e5570373912b	patch
https://github.com/NOAA-PMEL/LAS/compare/b4b7306..de5f923	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.