CVE-2025-21391

HIGH CISA KEV EPSS 79.8%
Published Feb 11, 20251y ago · Modified Jun 17, 20261w ago
7.1 CVSS 3.1
High
Find Similar
Published Feb 11, 2025 1y ago
Last Modified Jun 17, 2026 1w ago
KEV Listed Feb 11, 2025 1y ago
KEV Due Mar 4, 2025 483d overdue

Description

Windows Storage Elevation of Privilege Vulnerability

CVSS Details

Base Score
7.1
Exploitability
1.8
Impact
5.2
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality None
Integrity High
Availability High

Threat Intelligence

CISA Known Exploited Overdue 483d
Added
Feb 11, 2025
Due
Mar 4, 2025

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

EPSS Exploit Probability
79.8% percentile
Exploit & Patch Status
Actively Exploited (KEV)
Patch Available

Weaknesses 1

CWE-59

Affected Products 16

VendorProductVersionRange
microsoftwindows_10_1507* <10.0.10240.20915
microsoftwindows_10_1507* <10.0.10240.20915
microsoftwindows_10_1607* <10.0.14393.7785
microsoftwindows_10_1607* <10.0.14393.7785
microsoftwindows_10_1809* <10.0.17763.6893
microsoftwindows_10_1809* <10.0.17763.6893
microsoftwindows_10_21h2* <10.0.19044.5487
microsoftwindows_10_22h2* <10.0.19045.5487
microsoftwindows_11_22h2* <10.0.22621.4890
microsoftwindows_11_23h2* <10.0.22631.4890
microsoftwindows_11_24h2* <10.0.26100.3107
microsoftwindows_server_2016* <10.0.14393.7785
microsoftwindows_server_2019* <10.0.17763.6893
microsoftwindows_server_2022* <10.0.20348.3148
microsoftwindows_server_2022_23h2* <10.0.25398.1425
microsoftwindows_server_2025* <10.0.26100.3107

References 2

  • msrc.microsoft.com https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21391
    PatchVendor Advisory
  • cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-21391
    US Government Resource

Remediation

  • msrc.microsoft.com https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21391
    PatchVendor Advisory