CVE-2025-59516

HighCVSS 7.8/10Last modified Oct 7, 2026

Description

Missing authentication for critical function in Windows Storage VSP Driver allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-73 CWE-306

Affected software

Vendor	Product	Versions
Microsoft	Windows 10 Version 1809	>= 10.0.17763.0, < 10.0.17763.8146
Microsoft	Windows 10 Version 21H2	>= 10.0.19044.0, < 10.0.19044.6691
Microsoft	Windows 10 Version 22H2	>= 10.0.19045.0, < 10.0.19045.6691
Microsoft	Windows 11 version 22H3	>= 10.0.22631.0, < 10.0.22631.6345
Microsoft	Windows 11 Version 23H2	>= 10.0.22631.0, < 10.0.22631.6345
Microsoft	Windows 11 Version 24H2	>= 10.0.26100.0, < 10.0.26100.7462
Microsoft	Windows 11 Version 25H2	>= 10.0.26200.0, < 10.0.26200.7462
Microsoft	Windows Server 2019	>= 10.0.17763.0, < 10.0.17763.8146
Microsoft	Windows Server 2019 (Server Core installation)	>= 10.0.17763.0, < 10.0.17763.8146
Microsoft	Windows Server 2022	>= 10.0.20348.0, < 10.0.20348.4529
Microsoft	Windows Server 2022, 23H2 Edition (Server Core installation)	>= 10.0.25398.0, < 10.0.25398.2025
Microsoft	Windows Server 2025	>= 10.0.26100.0, < 10.0.26100.7462
Microsoft	Windows Server 2025 (Server Core installation)	>= 10.0.26100.0, < 10.0.26100.7462

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59516Vendor Advisory

Timeline

Published: Dec 9, 2025
Last modified: Oct 7, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-595177.8Improper access control in Windows Storage VSP Driver allows an authorized attacker to elevate privileges locally.CVE-2025-595188.0In LemonLDAP::NG before 2.16.7 and 2.17 through 2.21 before 2.21.3, OS command injection can occur in the Safe jail. It does not Localize _ CVE-2025-59527.3A vulnerability, which was classified as critical, has been found in Zend.To up to 6.10-6 Beta. This issue affects the function exec of the CVE-2025-595246.1Horilla is a free and open source Human Resource Management System (HRMS). Prior to version 1.4.0, the file upload flow performs validation CVE-2025-595256.1Horilla is a free and open source Human Resource Management System (HRMS). Prior to version 1.4.0, improper sanitization across the applicat CVE-2025-595262.7mailgen is a Node.js package that generates responsive HTML e-mails for sending transactional mail. Prior to version 2.0.30, there is an HTM CVE-2025-595277.5Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5, a Server-Side Request Forgery (SS CVE-2025-5952810.0Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5, Flowise is vulnerable to remote c CVE-2025-595295.5Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions up to and including CVE-2025-59538.8The WP Human Resource Management plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization in the ajax_insert_CVE-2025-595307.5quic-go is an implementation of the QUIC protocol in Go. In versions prior to 0.49.0, 0.54.1, and 0.55.0, a misbehaving or malicious server CVE-2025-595317.5Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions 1.2.0 through 1.8.7, 2.0.0-rc1 through 2.14.19, 3.0.0-rc1