CVE-2025-21391

HIGH7.1

CISA KEV

Published 2025-02-11 · Updated 2026-09-24 · Source secure@microsoft.com

Description

Windows Storage Elevation of Privilege Vulnerability

CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

CWE-59

CISA Known-Exploited Vulnerability

Product: Microsoft — Windows

Name: Microsoft Windows Storage Link Following Vulnerability

Date added: 2025-02-11 · Due: 2025-03-04

Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

References

View on NVD

Related CVEs

Same severity, most recent

CVE-2026-50218
Akamai GPA (Guardicore Platform Agent) client on all platforms before 7.4 improperly validates JWT tokens used for seeding. By convincing a user to interact with a malicious link, an attacker can use a spoofed JWT token to inject arbitrary parameters into the client software, resulting in unauthorized reconfiguration and full compromise of the application's functionality. This attack can also be targeted against an already seeded client if the attacker knows the URL of the IDP that the client used for enrollment.
2026-10-14 · score 8.5
CVE-2026-110459
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to obtain information, make unauthorized changes, and execute a Denial of Service (DoS) attack on the device.
2026-10-14 · score 8.6
CVE-2026-110455
A malicious actor with access to the network and under certain conditions could exploit an Improper Input Validation vulnerability found in UniFi Protect AI Key to execute a Command Injection on the device.
2026-10-14 · score 8.1
CVE-2026-110450
Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via a repair operation because it could destroy and then replace a store path before content verification.
2026-10-14 · score 8.0
CVE-2026-106931
SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.
2026-10-14 · score 7.8