CVE-2025-8095 - Recoverable obfuscation using the OECH1 prefix encoding in OpenEdge

Back Back to CVE browser

CRITICAL

Recoverable obfuscation using the OECH1 prefix encoding in OpenEdge

Published Apr 14, 2026

9.1

CRITICAL

CVSS 4.0

EPSS 0.22%

Description

The OECH1 prefix encoding is intended to obfuscate values across the OpenEdge platform. It has been identified as cryptographically weak and unsuitable for stored encodings and enterprise applications. OECH1 encodings should be considered exploitable and immediately replaced by any other supported prefix encoding, all of which are based on symmetric encryption.

Affected products

Vendor Progress Software Corporation Product OpenEdge Default
affected
Affected
- ≥ 12.2.0, ≤ 12.2.18
- ≥ 12.8.0, ≤ 12.8.9

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Progress Software Corporation	OpenEdge	affected	Affected ≥ 12.2.0, ≤ 12.2.18 ≥ 12.8.0, ≤ 12.8.9

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-257

References (2)

Link	Providers	Tags
https://community.progress.com/s/article/Unintended-Use-of-OECH1-for-Password-Secrets-Protection
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-209440		Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner ProgressSoftware

Published Apr 14, 2026

Updated Apr 15, 2026

Reserved Jul 23, 2025

Link CVE-2025-8095

CISA Vulnrichment

Updated Apr 14, 2026

NVD

Status Awaiting Analysis

Modified Oct 7, 2026

Link CVE-2025-8095

Red Hat

No data

ENISA EUVD

Assigner ProgressSoftware

Published Apr 14, 2026

Updated Apr 15, 2026

Link EUVD-2025-209440

GitHub

No data