CVE-2025-55077 - CVE House
Back to Database
Status published Medium CVE-2025-55077

Tyler Technologies ERP Pro 9 SaaS application escape

Vulnerability Description

Tyler Technologies ERP Pro 9 SaaS allows an authenticated user to escape the application and execute limited operating system commands within the remote Microsoft Windows environment with the privileges of the authenticated user. Tyler Technologies deployed hardened remote Windows environment settings to all ERP Pro 9 SaaS customer environments as of 2025-08-01.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-55077

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Shawn Plowman, Brookings County

References

More from Tyler Technologies

View All →
CVE-2023-6375
Tyler Technologies Magistrate Court Case Management Plus stores backups insecurely
Medium 5.3
CVE-2023-6354
Tyler Technologies Magistrate Court Case Management Plus PDFViewer.aspx allows authentication bypass
Medium 5.3
CVE-2023-6353
Tyler Technologies Civil and Criminal Electronic Filing Upload.aspx allows authentication bypass
Medium 5.3
CVE-2023-6344
Tyler Technologies Court Case Management Plus use of Aquaforest TIFF Server te003.aspx and te004.aspx allows authentication bypass
Medium 5.3
CVE-2023-6343
Tyler Technologies Court Case Management Plus use of Aquaforest TIFF Server tssp.aspx allows authentication bypass
Medium 5.3

Affected Vendor

Tyler Technologies

View all reports →

Affected Software

ERP Pro 9 SaaS
Vulnerable Versions:
0, 2025-08-01

Timeline

Official Publish: August 7th, 2025
Last Modified: August 12th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Weaknesses (CWE)

CWE-250 CWE-668 CWE-863

MITRE ATT&CK TTPs

T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1548 Abuse Elevation Control Mechanism
Defense Evasion
T1078 Valid Accounts
Persistence
T1574 Hijack Execution Flow
Privilege Escalation
T1485 Data Destruction
Impact
T1190 Exploit Public-Facing Application
Initial Access
T1213 Data from Information Repositories
Collection
T1005 Data from Local System
Collection
T1021 Remote Services
Lateral Movement
T1098 Account Manipulation
Defense Evasion