CVE-2025-47179CWE-284broken-access-control

CVE-2025-47179

Medium · published November 11, 2025

CVSS v3.1
6.7
EPSS
0%
Percentile
30.0
In the wild
Unconfirmed
What it is

Improper access control in Microsoft Configuration Manager allows an authorized attacker to elevate privileges locally.

The record
Technical detail
CVSS v3.1
6.7 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00372 · 30.0th percentile
Weakness
CWE-284 · Improper Access Control
Published
2025-11-11T23:15Z
Affected products (3)
ProductVersionsFixed in
microsoft/configuration_manager_2403< 5.00.9128.10375.00.9128.1037
microsoft/configuration_manager_2409< 5.00.9132.10315.00.9132.1031
microsoft/configuration_manager_2503< 5.0.9135.10135.0.9135.1013
References (1)
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47179 · [email protected]
EPSS history
Timeline
  • 11 NOV 17:59Z
    Configuration Manager Elevation of Privilege Vulnerability
    cvelistv5