Cyber Resilience

CVE-2025-50171

Critical

Published: 12 August 2025

Published
12 August 2025
Modified
14 August 2025
KEV Added
—
Patch
—
CVSS Score v3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS Score 0.0131 80.2th percentile
Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-50171 is a critical-severity Missing Authorization (CWE-862) vulnerability in Microsoft Windows Server 2022. Its CVSS base score is 9.1 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique External Remote Services (T1133); ranked in the top 19.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-17 (Remote Access) and AC-3 (Access Enforcement).

Deeper analysis

CVE-2025-50171 is a missing authorization vulnerability, tracked as CWE-862, that affects Remote Desktop Server and enables spoofing over a network. The flaw received a CVSS 3.1 score of 9.1, reflecting an unauthenticated network attack with low complexity and no user interaction that can produce high confidentiality and integrity consequences.

An unauthorized attacker positioned on the network can exploit the issue to carry out spoofing, allowing impersonation that affects data confidentiality and integrity without requiring credentials.

The Microsoft Security Response Center advisory published at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-50171 documents the vulnerability. The associated EPSS score has remained flat at 0.0131 with no material rise from its recorded peak.

EU & UK References

Vulnerability details

Missing authorization in Remote Desktop Server allows an unauthorized attacker to perform spoofing over a network.

CWE(s)
CWE-862

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1133 External Remote Services Persistence
Adversaries may leverage external-facing remote services to initially access and/or persist within a network.
attack.mitre.org →
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Missing authorization in exposed RDP server directly enables unauthenticated network spoofing for initial access via external remote services or public-facing app exploitation.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-49723Same product: Microsoft Windows Server 2022
CVE-2025-59287Same product: Microsoft Windows Server 2022
CVE-2026-21243Same product: Microsoft Windows Server 2022
CVE-2025-24064Same product: Microsoft Windows Server 2022
CVE-2025-50163Same product: Microsoft Windows Server 2022
CVE-2025-54106Same product: Microsoft Windows Server 2022
CVE-2026-26154Same product: Microsoft Windows Server 2022
CVE-2025-21309Same product: Microsoft Windows Server 2022
CVE-2025-49735Same product: Microsoft Windows Server 2022
CVE-2025-21326Same product: Microsoft Windows Server 2022 23H2

Affected Assets

microsoft
windows server 2022
≤ 10.0.20348.3989
microsoft
windows server 2022 23h2
≤ 10.0.25398.1791
microsoft
windows server 2025
≤ 10.0.26100.4851

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match
prevent

AC-3 requires systems to enforce approved authorizations for access, directly addressing the missing authorization that enables unauthorized spoofing in Remote Desktop Server.

SC-23 Session Authenticity good match
prevent

SC-23 protects the authenticity of communications sessions, preventing spoofing attacks over the network in Remote Desktop Server.

AC-17 Remote Access good match
prevent

AC-17 authorizes and manages remote access connections, mitigating unauthorized network access and spoofing in Remote Desktop Server.

References