The vulnerability exists in PMWeb's encryptionhelper.dll library used in the v7.x, v8.x, and v2025.x product lines. Manipulating an unknown function within this DLL allows an attacker to read data that should remain private, leading to a confidential disclosure of potentially sensitive information. This weakness is categorized as an information exposure flaw (CWE‑200) with a related authorization lapse (CWE‑284). The disclosed data can compromise privacy but does not directly alter system configuration or cause denial of service.

Affected systems are the PMWeb application released under the PMWeb brand. The vulnerable versions are PMWeb v7.x, v8.x, and v2025.x. No patches or workarounds are currently provided by the vendor, and the CVE entry indicates that the vendor did not respond to early disclosure attempts.

The risk rating is moderate with a CVSS score of 6.9, and while an exploit could be run remotely, no exploit score or proof‑of‑concept is documented. The EPSS score is not provided, and the vulnerability is not listed in the CISA KEV catalog. Until an official fix is available, it remains potentially exploitable by remote parties, but the description does not state whether authentication is required to trigger the vulnerable function.