CVE-2025-21396
Published: 29 January 2025
Summary
CVE-2025-21396 is a high-severity Missing Authorization (CWE-862) vulnerability in Microsoft Account. Its CVSS base score is 8.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 16.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-24 (Access Control Decisions).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Enforces approved authorizations for logical access to information and system resources, directly mitigating the missing authorization that allows unauthorized privilege escalation.
Employs least privilege to restrict access rights, limiting the scope and impact of privilege elevation from unauthorized actions.
Requires authorization decisions for access to system resources by defined personnel or roles, addressing the lack of authorization checks in privilege elevation paths.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The missing authorization vulnerability directly enables remote unauthorized privilege escalation within Microsoft Account, mapping to exploitation of software vulnerabilities for privilege escalation.
NVD Description
Missing authorization in Microsoft Account allows an unauthorized attacker to elevate privileges over a network.
Deeper analysisAI
CVE-2025-21396 is a missing authorization vulnerability (CWE-862) affecting Microsoft Account. Published on 2025-01-29, it enables an unauthorized attacker to elevate privileges over a network. The vulnerability carries a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H), reflecting high severity from its network reachability, low complexity, lack of required privileges or user interaction, and impacts on integrity (low) and availability (high).
An unauthenticated attacker (PR:N) can exploit this flaw remotely over the network (AV:N) with low complexity and no user interaction. Exploitation allows privilege elevation within Microsoft Account, potentially disrupting service availability at a high level while causing low-level integrity violations, such as unauthorized modifications.
The official Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21396 provides details on mitigation, including any available patches or workarounds.
Details
- CWE(s)