CVE-2025-58074
Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HSummary
CVE-2025-58074 is a high-severity Insecure Operation on Windows Junction / Mount Point (CWE-1386) vulnerability in Norton Secure VPN (inferred from references). Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Direct Volume Access (T1006); ranked at the 3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-58074 is a privilege escalation vulnerability affecting the installation process of Norton Secure VPN when downloaded via the Microsoft Store. During installation, a low-privilege user can replace files, potentially leading to the deletion of arbitrary files and subsequent elevation of privileges. The vulnerability is rated with a CVSS v3.1 base score of 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) and is associated with CWE-1386.
A low-privilege local user can exploit this vulnerability by interfering with the file replacement mechanism during the Norton Secure VPN installation from the Microsoft Store. Successful exploitation allows the attacker to delete arbitrary files, which can result in privilege escalation, granting higher-level access on the affected system and enabling confidentiality, integrity, and availability impacts.
Mitigation details and additional technical information are available in the Cisco Talos Intelligence advisory at https://talosintelligence.com/vulnerability_reports/TALOS-2025-2276.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-209612
Vulnerability Data
A privilege escalation vulnerability exists during the installation of Norton Secure VPN via the Microsoft Store. A low-privilege user can replace files during the installation process, which may result in deletion of arbitrary files that can lead to elevation of…
more
privileges.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V5.3.3
Mitigating Controls (NIST 800-53 r5) AI
Enforcing authorizations on file/directory opens structurally blocks access via junctions that escape the intended scope.
Information-flow rules that validate the final target of a name prevent unintended data access through mount points or junctions.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent improper junction/mount-point handling during design and coding.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect junction/mount-point weaknesses before release.
Secure development lifecycle can mandate junction/mount-point validation during design and coding.
Application security requirements can explicitly require protection against Windows reparse-point attacks.
Secure system architecture principles include canonicalization and path-traversal defenses that mitigate junction attacks.
Secure coding standards directly address safe file/directory handling to prevent insecure junction operations.
Information access restriction reduces exposure but does not prevent the technical flaw itself.