CVE-2012-5357: Ektron CMS XSLT script execution allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityCVSS 3.0 base score is 9.8 with network reachability, no authentication, and no user interaction, and public exploit code plus a high EPSS percentile make active exploitation likely.

What it is

Ektron CMS before 8.02 SP5 uses the XslCompiledTransform class with enablescript set to true, so crafted XSL data is processed as executable script. This lets an unauthenticated remote attacker run arbitrary code on the server, and the flaw is severe because it needs no credentials or user action.

Impact

An attacker gains arbitrary code execution with NETWORK SERVICE privileges on the Ektron CMS host, which can lead to full compromise of the web application and its data.

Attack surface

The flaw is reachable over the network through the CMS's XSL processing path, per the CVSS vector AV:N/AC:L/PR:N/UI:N, meaning no authentication and no user interaction are required.

Exploitation

CVE-2012-5357 is not listed in CISA KEV, but public exploit code exists (Rapid7 Metasploit module and a third-party writeup tagged Exploit), and EPSS shows a 30-day probability of 0.67776 (99.3rd percentile), indicating high likelihood of exploitation activity.

What to do

• Upgrade Ektron CMS to version 8.02 SP5 or later, which disables script execution in XSLT processing.
• If immediate upgrade is not possible, restrict network access to the CMS administrative and XSL-processing endpoints to trusted sources only.
• Run the Ektron application under a low-privilege service account rather than NETWORK SERVICE to limit post-exploitation impact.
• Monitor vendor and Microsoft advisories for any additional XSLT hardening guidance and apply it.
• Review and remove any unnecessary XSLT upload or transformation features exposed to untrusted users.

Detection

• Inspect web server and application logs for requests containing XSL or XSLT payloads, especially those with script or extension elements.
• Monitor for unexpected child processes spawned by the Ektron web application or its application pool, such as cmd.exe or powershell.exe.
• Alert on outbound network connections or file writes originating from the Ektron service account that deviate from normal CMS behavior.
• Use the Rapid7 Metasploit module signature (exploit/windows/http/ektron_xslt_exec) to build IDS/IPS rules for known exploit traffic.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.