CVE-2025-41086

MEDIUM EPSS 7.7%

Published Dec 2, 20257mo ago · Modified Jun 17, 20262w ago

6.9 CVSS 4.0

Medium

Published Dec 2, 2025 7mo ago

Last Modified Jun 17, 2026 2w ago

Description

Vulnerability in the access control system of the GAMS licensing system that allows unlimited valid licenses to be generated, bypassing any usage restrictions. The validator uses an insecure checksum algorithm; knowing this algorithm and the format of the license lines, an attacker can recalculate the checksum and generate a valid license to grant themselves full privileges without credentials or access to the source code, allowing them unrestricted access to GAMS's mathematical models and commercial solvers.

CVSS Details

Base Score

6.9

Exploitability

—

Impact

—

Vector string

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction None

Scope X

Threat Intelligence

EPSS Exploit Probability

7.7% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-639

Affected Products 2

Vendor	Product	Version	Range
gams	gams	*	<48.7.0
gams	gams	*	≥49.1.0 – <49.7.0

References 2

gams.com https://www.gams.com/latest/docs/RN_51.html

Release Notes
incibe.es https://www.incibe.es/en/incibe-cert/notices/aviso/authorization-bypass-gams-gams-development-corp

Third Party Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.