CVE-2025-60718CWE-426

CVE-2025-60718

High · published November 11, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
37.2
In the wild
Unconfirmed
What it is

⚡ A sneaky untrusted search path in Windows Administrator Protection could let an authorized attacker gain elevated privileges! Think of it like a VIP pass to a concert that lets someone backstage, but they’re not on the guest list. They simply found a way around the security check that should have stopped them! 🎟️ If exploited, an attacker could gain access to sensitive areas of the system, altering settings, accessing confidential data, or even installing malicious software. It’s like letting a mischievous guest roam freely in a secure area, potentially causing chaos!

Put simply

Think of it like a VIP pass to a concert that lets someone backstage, but they’re not on the guest list. They simply found a way around the security check that should have stopped them! 🎟️ This vulnerability occurs due to an untrusted search path, allowing an authorized user to execute files with elevated privileges, thereby compromising system security.

What to do

If exploited, an attacker could gain access to sensitive areas of the system, altering settings, accessing confidential data, or even installing malicious software. It’s like letting a mischievous guest roam freely in a secure area, potentially causing chaos! To mitigate this risk, ensure you configure the system to use trusted paths only, limit user permissions as much as possible, and regularly audit user access. Keeping your Windows systems updated is crucial! You’ve got this! By following these steps, you can shore up your defenses and keep things secure. 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00440 · 37.2th percentile
Weakness
CWE-426 · Untrusted Search Path
Published
2025-11-11T23:15Z
Affected products (2)
ProductVersionsFixed in
microsoft/windows_11_24h2< 10.0.26100.709210.0.26100.7092
microsoft/windows_11_25h2< 10.0.26200.709210.0.26200.7092
References (1)
EPSS history
Timeline
  • 11 NOV 17:59Z
    Windows Administrator Protection Elevation of Privilege Vulnerability
    cvelistv5