CVE-2025-27743
Published: 08 April 2025
Summary
CVE-2025-27743 is a high-severity Untrusted Search Path (CWE-426) vulnerability in Microsoft System Center Data Protection Manager. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 24.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2025-27743 is an untrusted search path vulnerability, tracked under CWE-426, that affects Microsoft System Center. The flaw carries a CVSS 3.1 base score of 7.8 and permits an attacker who already possesses local access to influence executable search paths, resulting in privilege escalation on the affected host.
An authorized local attacker can exploit the condition without user interaction or elevated privileges beyond standard user rights. Successful exploitation grants the attacker full control over confidentiality, integrity, and availability on the system, consistent with the high impact metrics assigned to the vulnerability.
Microsoft has published an advisory for CVE-2025-27743 at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-27743 that includes remediation guidance and patch availability.
The associated EPSS score rose from a low baseline to a recorded peak of 0.0160, indicating emerging exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-10147
Vulnerability details
Untrusted search path in System Center allows an authorized attacker to elevate privileges locally.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.