Output Messenger CVE-2025-27920: Zero-Day Used for Espionage

What to do

1. Find every Output Messenger server and client in your estate and record its version.
2. Upgrade the server and clients to the current release; 2.0.63 is the minimum for this CVE and CVE-2025-27921.
3. Take the server off the internet and reach it only over a VPN or internal network.
4. Reset every user's password and turn on Output Messenger's two-way authentication, since the attack needs a valid login.
5. If a server ran an older build while exposed, run the checks below and rebuild it if any indicator is present.

How to check if you are affected or compromised

• Look for OMServerService.vbs or OM.vbs in C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp on the server.
• Look for OMServerService.exe or OM.vbs in C:\Users\Public\Videos on the server and for an unexpected OMClientService.exe on clients.
• Search DNS and proxy logs for api.wordinfos[.]com, Microsoft's listed C2 domain (first seen Apr 5, 2024).
• Check for plink.exe use and for RAR archives created on user desktops, which Microsoft saw before exfiltration.

What happened#

Output Messenger is a self-hosted chat, file-sharing and VoIP tool made by Srimax. Its server holds every user's messages and files. On December 25, 2024, Srimax released 2.0.63, which its release notes say fixes a directory traversal (CVE-2025-27920) and an XSS (CVE-2025-27921). The vendor advisory says ../ sequences in file paths let an attacker reach files outside the intended folder, and it credits the Microsoft Security Response Center. The CVE record was published on May 5, 2025.

On May 12, 2025, Microsoft Threat Intelligence said the bug had been a zero-day. It says Marbled Dust, a "Türkiye-affiliated espionage threat actor" that overlaps with Sea Turtle and UNC1326, had used it since April 2024 against targets it links "with high confidence" to the Kurdish military in Iraq. The flaw sits in the Output Messenger Server Manager. It lets an authenticated user write files into the server's Windows startup folder. Microsoft does not know how the actor got logins in each case; it assesses that DNS hijacking or typo-squatted domains were used to capture credentials.

The actor dropped OMServerService.vbs in the startup folder and a Go backdoor, OMServerService.exe, in Users/public/videos. On clients it planted OMClientService.exe, a second backdoor that runs commands from the C2 server. Microsoft says the goal was "indiscriminate access to the communications of every user". CISA added the CVE to the KEV catalog on May 19, 2025.

Who is affected#

Output Messenger before 2.0.63. Microsoft lists 2.0.63 for Windows and 2.0.62 for Server as the safe builds. The vendor's current Windows release is V3.0.2. The CNA scores the bug CVSS 3.1 7.2. NVD scores it 8.8, with low privileges required and high impact. In May 2025, Censys counted 827 internet-facing instances, 620 of them apparently on vulnerable versions. The most common were far older builds such as 2.0.15 and 2.0.22.

Do you really need to act?#

Most organizations do not run this product. If you do, check it. The fix is almost two years old, but the attackers had about eight months of zero-day access first, and the Censys data shows how many servers never get updated. A chat server is a high-value target: one foothold exposes every conversation and file. Upgrading does not remove a backdoor planted earlier, so a server that was exposed before 2.0.63 needs a hunt, not just a patch.

What to do now#

1. Inventory every Output Messenger server and client, and record each version.
2. Upgrade the server and all clients to the current release. 2.0.63 is the floor.
3. Move the server behind a VPN or onto an internal-only network.
4. Reset all user passwords and turn on two-way authentication.
5. If any indicator below turns up, isolate the server, keep the evidence, rebuild it from clean media, and treat all chat history as exposed.

How to tell if you were hit#

• On the server, run Get-ChildItem "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp" -Force and look for OMServerService.vbs or OM.vbs.
• Run Get-ChildItem C:\Users\Public\Videos -Force and look for OMServerService.exe or OM.vbs. On clients, check for an OMClientService.exe you did not install.
• Search DNS, proxy and firewall logs for api.wordinfos[.]com. Microsoft also lists two VBS hashes: 1df959e4d2f48c4066fddcb5b3fd00b0b25ae44f350f5f35a86571abb2852e39 and 2b7b65d6f8815dbe18cabaa20c01be655d8475fc429388a4541eff193596ae63.
• Look for plink.exe runs and RAR files on desktops, which Microsoft saw before data was sent out.

Timeline#

• Apr 5, 2024 — The Marbled Dust C2 domain is first seen. Microsoft dates exploitation to April 2024.
• Dec 25, 2024 — Srimax ships 2.0.63 with fixes for CVE-2025-27920 and CVE-2025-27921.
• May 5, 2025 — The CVE record is published.
• May 12, 2025 — Microsoft publishes its Marbled Dust report. The Register covers it the next day.
• May 19, 2025 — CISA adds the CVE to KEV, with a June 9 deadline.

Vulnerability records

• CVE-2025-27920 · KEV 2025-05-19 · Output Messenger before 2.0.63 was vulnerable to a directory traversal attack through improper file path handling.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Srimax — CVE-2025-27920: Directory Traversal Vulnerability outputmessenger.com
2. Srimax — Output Messenger release notes outputmessenger.com
3. CVE record — CVE-2025-27920 cve.org
4. NVD — CVE-2025-27920 nvd.nist.gov
5. CISA — Known Exploited Vulnerabilities: CVE-2025-27920 cisa.gov
6. Microsoft Threat Intelligence — Marbled Dust leverages zero-day in Output Messenger for regional espionage microsoft.com
7. CVE record — CVE-2025-27921 cve.org
8. Censys — Srimax Output Messenger directory traversal vulnerability added to CISA KEV (CVE-2025-27920) censys.com

Coverage and analysis

1. The Register — Türkiye-linked spy crew exploited a messaging app zero-day to snoop on Kurdish army in Iraq theregister.com