CVE-2025-26645
Published: 11 March 2025
Summary
CVE-2025-26645 is a high-severity Relative Path Traversal (CWE-23) vulnerability in Microsoft Windows Server 2008. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 31.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-26645 is a relative path traversal vulnerability in the Remote Desktop Client that allows an unauthorized attacker to execute code over a network. Published on 2025-03-11, it is linked to CWE-23 (Relative Path Traversal) and CWE-284 (Improper Access Control), with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
The vulnerability can be exploited by an unauthorized attacker over the network with low attack complexity and no required privileges, though it requires user interaction. Successful exploitation enables high-impact effects on confidentiality, integrity, and availability, including arbitrary code execution.
Mitigation details are provided in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26645.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-6309
Vulnerability details
Relative path traversal in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a client-side remote code execution vulnerability in the Remote Desktop Client (requiring user interaction to connect over the network), which directly maps to exploitation of a client application for code execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Timely flaw remediation directly addresses the specific path traversal vulnerability in Remote Desktop Client by applying vendor patches to prevent code execution.
Information input validation prevents relative path traversal attacks by checking and sanitizing file path inputs in the Remote Desktop Client.
Access enforcement mechanisms mitigate CWE-284 improper access control by ensuring only authorized paths and resources are accessible despite traversal attempts.