CVE-2025-59213
Published: 14 October 2025
Summary
CVE-2025-59213 is a high-severity SQL Injection (CWE-89) vulnerability in Microsoft Configuration Manager 2403. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 33.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-10 directly prevents SQL injection vulnerabilities like CVE-2025-59213 by requiring validation of all inputs to SQL commands in Microsoft Configuration Manager.
SI-2 mandates timely remediation of flaws, including applying patches for the specific SQL injection vulnerability in CVE-2025-59213 as advised by MSRC.
SC-7 enforces boundary protection to restrict adjacent network access, blocking unauthorized attackers from exploiting the SQL injection in Configuration Manager.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in Microsoft Configuration Manager enables arbitrary database queries for data collection (T1213.006), exploitation of a remote management service (T1210), and privilege escalation via the vulnerability (T1068).
NVD Description
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an unauthorized attacker to elevate privileges over an adjacent network.
Deeper analysisAI
CVE-2025-59213 is an SQL injection vulnerability (CWE-89) in Microsoft Configuration Manager, stemming from improper neutralization of special elements used in an SQL command. Published on 2025-10-14, it carries a CVSS v3.1 base score of 8.8 (High), with vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating high impacts on confidentiality, integrity, and availability.
An unauthorized attacker on an adjacent network can exploit this vulnerability with low complexity and no required privileges or user interaction. Successful exploitation enables privilege escalation, potentially allowing the attacker to gain elevated access within the affected Configuration Manager environment.
The Microsoft Security Response Center (MSRC) advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59213 provides details on mitigation and available patches. Security practitioners should consult this resource for specific remediation steps, such as applying updates to vulnerable installations.
Details
- CWE(s)