CVE-2025-48927: TeleMessage Spring Boot Actuator heap dump endpoint exposed by insecure default

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is in CISA KEV with confirmed in-the-wild exploitation and a high EPSS percentile, though the direct confidentiality impact is rated medium.

What it is

TeleMessage through 2025-05-05 ships with Spring Boot Actuator configured to expose the /heapdump endpoint. Because this is an insecure default initialization, the endpoint is reachable without authentication and can leak the contents of the Java heap. The record states it was exploited in the wild in May 2025.

Impact

An unauthenticated attacker can download a heap dump and extract secrets, credentials, tokens or other sensitive in-memory data. This can enable further compromise of the TeleMessage service and connected systems.

Attack surface

Reachable over the network via the exposed /heapdump URI on the TeleMessage service; the CVSS vector shows no privileges or user interaction required. No authentication is needed per the vector and description.

Exploitation

CISA added it to KEV on 2025-07-01 with a due date of 2025-07-22, and the description states it was exploited in the wild in May 2025. EPSS 30-day probability is 0.11104 (95.7th percentile), indicating elevated likelihood.

What to do

• Apply vendor mitigations or upgrade TeleMessage to a version that does not expose the heap dump endpoint; if no fix is available, discontinue use per CISA guidance.
• Disable or restrict Spring Boot Actuator endpoints, especially /heapdump, and require authentication/authorization for management endpoints.
• Block external access to management/actuator paths at the network edge or reverse proxy.
• Rotate any credentials, tokens or keys that may have been present in the Java heap.
• Monitor for and investigate any prior access to /heapdump.

Detection

• Search web/proxy/access logs for requests to /heapdump or other Spring Boot Actuator endpoints.
• Alert on large outbound responses from management endpoints or unusual downloads from the TeleMessage service.
• Review TeleMessage/Spring Boot configuration for exposed actuator endpoints and verify authentication is enforced.
• Hunt for post-exploitation use of credentials or tokens that may have been extracted from heap dumps.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.