A recon of the AdminServer exposes two RMI methods—setFile() and openFile()—that were incorrectly implemented, allowing authenticated users to request the server to read any file on the underlying operating system. The privilege misassertion grants users full OS‑level read access, potentially exposing sensitive configuration files, credentials, or other data. This flaw matches the CWE‑552 pattern of unauthorized file access.

The vulnerability affects Progress Software Corporation’s OpenEdge platform on all supported operating systems. All versions of OpenEdge that include the AdminServer component in the RMI interface are susceptible until the methods are removed.

The CVSS base score of 8.2 indicates a high severity level. No EPSS value is available, and the issue is not listed in the CISA KEV catalog. Exploitation requires authenticated network access to the AdminServer’s RMI services. Therefore, attackers who can obtain valid credentials or compromise an existing authenticated session can trigger the unauthorized file read, making the risk significant for any exposed RMI endpoint.