CVE-2025-64655
Published: 20 November 2025
Summary
CVE-2025-64655 is a high-severity Improper Authorization (CWE-285) vulnerability in Microsoft Dynamics Omnichannel Sdk Storage Containers. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 24.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-24 (Access Control Decisions) and AC-3 (Access Enforcement).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Enforces approved authorizations for access to system resources, directly mitigating the improper authorization flaw enabling privilege elevation in storage containers.
Requires access control decisions based on explicit authorizations, addressing the flawed authorization mechanisms that allow unauthorized privilege escalation.
Limits privileges to the minimum necessary, reducing the impact of successful privilege elevation via the authorization vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE enables remote unauthorized privilege escalation through improper authorization in a network-accessible service, directly facilitating T1068 (Exploitation for Privilege Escalation) and T1190 (Exploit Public-Facing Application).
NVD Description
Improper authorization in Dynamics OmniChannel SDK Storage Containers allows an unauthorized attacker to elevate privileges over a network.
Deeper analysisAI
CVE-2025-64655 is an improper authorization vulnerability (CWE-285) in the Dynamics OmniChannel SDK Storage Containers. Published on 2025-11-20T23:15:56.750, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The issue stems from flawed authorization mechanisms that enable unauthorized privilege elevation over a network.
An unauthorized attacker can exploit this vulnerability remotely with low complexity and no required privileges, though user interaction is necessary. Successful exploitation allows the attacker to achieve high impacts on confidentiality, integrity, and availability, specifically by elevating privileges within the affected storage containers.
Security practitioners should consult the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-64655 for details on patches, workarounds, and mitigation guidance.
Details
- CWE(s)