CVE-2025-59501CWE-290

CVE-2025-59501

Medium · published October 31, 2025

CVSS v3.1
4.8
EPSS
3%
Percentile
88.3
In the wild
Unconfirmed
What it is

Authentication bypass by spoofing in Microsoft Configuration Manager allows an authorized attacker to perform spoofing over an adjacent network.

The record
Technical detail
CVSS v3.1
4.8 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.03255 · 88.3th percentile
Weakness
CWE-290 · Authentication Bypass by Spoofing
Published
2025-10-31T21:15Z
Affected products (3)
ProductVersionsFixed in
microsoft/configuration_manager_2403< 5.00.9128.10375.00.9128.1037
microsoft/configuration_manager_2409< 5.00.9132.10315.00.9132.1031
microsoft/configuration_manager_2503< 5.0.9135.10135.0.9135.1013
References (1)
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59501 · [email protected]
EPSS history
Timeline
  • 31 OCT 16:45Z
    Microsoft Configuration Manager Spoofing Vulnerability
    cvelistv5