CVE-2025-60021

CVE

Threat entity extracted from intelligence sources

Frequency

occurrences

First Seen

January 28, 2026

Last Seen

January 28, 2026

API

Exploited in Wild

—

Ransomware Use

—

Public Exploits

—

Attack Vector

—

Vulnerability Overview

Exploitation Activity

Exploitation Intelligence

Critical Command Injection Vulnerability in Apache bRPC Identified38.8

CyberArk Labs has discovered a critical command injection vulnerability in Apache bRPC, allowing unauthenticated remote code execution via the exposed /pprof/heap HTTP endpoint. The issue has been assigned CVE-2025-60021 by Apache with a CVSS score of 9.8, attributed to researcher Simon Kosman.