CVE-2025-60704CWE-325

Windows Kerberos Elevation of Privilege Vulnerability

High · published November 11, 2025

CVSS v3.1
7.5
EPSS
1%
Percentile
46.2
In the wild
Unconfirmed
What it is

⚡ A missing cryptographic step in Windows Kerberos opens the door for attackers to elevate privileges without breaking a sweat! 🔑 Think of Kerberos as a special VIP lounge where only authorized guests can enter. This vulnerability is like a minor oversight that lets anyone slip past the bouncer — unauthorized access to the inner circle! If exploited, an attacker could gain elevated privileges on the network, potentially leading to unauthorized access to sensitive data, system control, or even lateral movement to other networked systems. It's like handing over the keys to the kingdom without a second thought!

Put simply

Think of Kerberos as a special VIP lounge where only authorized guests can enter. This vulnerability is like a minor oversight that lets anyone slip past the bouncer — unauthorized access to the inner circle! This vulnerability arises from a missing cryptographic validation process in Windows Kerberos, allowing unauthorized users to bypass normal access controls through privilege escalation.

What to do

If exploited, an attacker could gain elevated privileges on the network, potentially leading to unauthorized access to sensitive data, system control, or even lateral movement to other networked systems. It's like handing over the keys to the kingdom without a second thought! To protect your systems, ensure that you apply the latest security updates from Microsoft addressing this issue. Regularly audit user permissions and monitor access logs for unusual activity. Don't wait for an invitation — secure your network now! You've got this! With these steps, you're on the path to locking down your systems and keeping the virtual bouncers in check! 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.00566 · 46.2th percentile
Weakness
CWE-325 · Missing Cryptographic Step
Published
2025-11-11T17:59Z
EPSS history
Timeline
  • 11 NOV 17:59Z
    Windows Kerberos Elevation of Privilege Vulnerability
    cvelistv5