CVE-2025-21333

HIGH CISA KEV EPSS 94.9%

Published Jan 14, 20251y ago · Modified Jun 17, 20261w ago

7.8 CVSS 3.1

High

Published Jan 14, 2025 1y ago

Last Modified Jun 17, 2026 1w ago

KEV Listed Jan 14, 2025 1y ago

KEV Due Feb 4, 2025 511d overdue

Description

Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability

Base Score

7.8

Exploitability

1.8

Impact

5.9

Vector string

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector Local

Attack Complexity Low

Privileges Required Low

User Interaction None

Scope Unchanged

Confidentiality High

Integrity High

Availability High

CISA Known Exploited Overdue 511d

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

EPSS Exploit Probability

94.9% percentile

Exploit & Patch Status

Actively Exploited (KEV)

Patch Available

CWE-122

Vendor	Product	Version	Range
microsoft	windows_10_21h2	*	<10.0.19044.5371
microsoft	windows_10_22h2	*	<10.0.19045.5371
microsoft	windows_11_22h2	*	<10.0.22621.4751
microsoft	windows_11_23h2	*	<10.0.22631.4751
microsoft	windows_11_24h2	*	<10.0.26100.2894
microsoft	windows_server_2022_23h2	*	<10.0.25398.1369
microsoft	windows_server_2025	*	<10.0.26100.2894

msrc.microsoft.com https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21333

PatchVendor Advisory
cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-21333

US Government Resource
exploit-db.com https://www.exploit-db.com/exploits/52436

ExploitThird Party AdvisoryVDB Entry
vicarius.io https://www.vicarius.io/vsociety/posts/cve-2025-21333-elevated-privilege-exposure-in-windows-hyper-v-by-microsoft-detection-script

MitigationThird Party Advisory
vicarius.io https://www.vicarius.io/vsociety/posts/cve-2025-21333-elevated-privilege-exposure-in-windows-hyper-v-by-microsoft-mitigation-script

MitigationThird Party Advisory

msrc.microsoft.com https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21333

PatchVendor Advisory