CVE-2025-21391

HighCVSS 7.1/10Known exploited (CISA KEV)Last modified Sep 24, 2026

Description

Windows Storage Elevation of Privilege Vulnerability

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-59

Affected software

No affected versions have been published.

Timeline

Published
Feb 11, 2025
Last modified
Sep 24, 2026
Added to CISA KEV
Feb 11, 2025
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-213927.8Microsoft Office Remote Code Execution VulnerabilityCVE-2025-213936.3Microsoft SharePoint Server Spoofing VulnerabilityCVE-2025-213947.8Microsoft Excel Remote Code Execution VulnerabilityCVE-2025-213957.8Microsoft Access Remote Code Execution VulnerabilityCVE-2025-213968.2Missing authorization in Microsoft Account allows an unauthorized attacker to elevate privileges over a network.CVE-2025-213977.8Microsoft Office Remote Code Execution VulnerabilityCVE-2025-213997.4Microsoft Edge (Chromium-based) Update Elevation of Privilege VulnerabilityCVE-2025-21405.7IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to spoof email ideCVE-2025-214008.0Microsoft SharePoint Server Remote Code Execution VulnerabilityCVE-2025-214014.5Microsoft Edge (Chromium-based) Security Feature Bypass VulnerabilityCVE-2025-214027.8Microsoft Office OneNote Remote Code Execution VulnerabilityCVE-2025-214036.4On-Premises Data Gateway Information Disclosure Vulnerability
CVE-2025-21391: High severity, CVSS 7.1 | Vulnix