Cyber Resilience

CVE-2025-21380

High

Published: 09 January 2025

Published
09 January 2025
Modified
05 February 2025
KEV Added
—
Patch
—
CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0466 89.6th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-21380 is a high-severity Improper Access Control (CWE-284) vulnerability in Microsoft Azure Marketplace. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 10.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).

Deeper analysis

CVE-2025-21380 is an improper access control vulnerability, tracked under CWE-284, that affects Azure SaaS Resources. The flaw received a CVSS 3.1 base score of 8.8 and permits an authorized attacker to interact with the component across a network.

An attacker who already possesses low-privileged credentials can exploit the issue remotely without user interaction, resulting in high impact to confidentiality, integrity, and availability of the affected Azure SaaS Resources.

Microsoft’s Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21380 supplies the official guidance on mitigation and patching.

EPSS for the CVE rose from a low baseline to a peak of 0.1063 on 2026-02-03 before receding to the current value of 0.0466, indicating a period of increased exploitation interest after disclosure.

EU & UK References

Vulnerability details

Improper access control in Azure SaaS Resources allows an authorized attacker to disclose information over a network.

CWE(s)
CWE-284NVD-CWE-Other

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1530 Data from Cloud Storage Collection
Adversaries may access data from cloud storage.
attack.mitre.org →
Why these techniques?

Improper access control in Azure SaaS enables remote exploitation from low-priv accounts (T1190) to achieve privilege escalation effects (T1068) and unauthorized data access (T1530).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-24989Same vendor: Microsoft
CVE-2025-53763Same vendor: Microsoft
CVE-2025-59273Same vendor: Microsoft
CVE-2026-24300Same vendor: Microsoft
CVE-2026-24306Same vendor: Microsoft
CVE-2025-55244Same vendor: Microsoft
CVE-2026-24304Same vendor: Microsoft
CVE-2026-42823Same vendor: Microsoft
CVE-2025-24076Same vendor: Microsoft
CVE-2025-21359Same vendor: Microsoft

Affected Assets

microsoft
azure marketplace
all versions

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match
prevent

Directly enforces approved authorizations to mitigate improper access control allowing low-privilege attackers to disclose sensitive information in Azure SaaS Resources.

AC-6 Least Privilege good match
prevent

Applies least privilege to restrict low-privilege (PR:L) users from accessing or disclosing unauthorized information over the network.

SI-2 Flaw Remediation good match
prevent

Remediates the specific improper access control flaw via timely patching as detailed in the Microsoft advisory, preventing exploitation.

References