Azure Storage Mover Remote Code Execution Vulnerability

On April 18th 2025, Microsoft announced Exchange Server Security Changes for Hybrid Deployments and accompanying non-security Hot Fix. Microsoft made these changes in the general interest of improving the security of hybrid Exchange deployments. Following further investigation, Microsoft identified specific security implications tied to the guidance and configuration steps outlined in the April announcement. Microsoft is issuing CVE-2025-53786 to document a vulnerability that is addressed by taking the steps documented with the April 18th announcement. Microsoft strongly recommends reading the information, installing the April 2025 (or later) Hot Fix and implementing the changes in your Exchange Server and hybrid environment.

A remote code execution vulnerability exists when Windows Hyper-V Network Switch on a host server fails to properly validate input from an authenticated user on a guest operating system. To exploit the vulnerability, an attacker could run a specially crafted application on a guest operating system that could cause the Hyper-V host operating system to execute arbitrary code. An attacker who successfully exploited the vulnerability could execute arbitrary code on the host operating system. The security update addresses the vulnerability by correcting how Windows Hyper-V Network Switch validates guest operating system network traffic.

Dynamics Business Central Remote Code Execution Vulnerability

Use after free in DNS Server allows an authorized attacker to execute code over a network.

An authenticated attacker can exploit an untrusted search path vulnerability in Microsoft Dataverse to execute code over a network.

Windows Distributed File System (DFS) Remote Code Execution Vulnerability

Microsoft Defender for IoT Elevation of Privilege Vulnerability

Secure Boot Security Feature Bypass Vulnerability

Microsoft Defender for IoT Elevation of Privilege Vulnerability

Visual Studio Elevation of Privilege Vulnerability

Azure Data Studio Elevation of Privilege Vulnerability

Microsoft Intune Linux Agent Elevation of Privilege Vulnerability

Improper access control in GitHub Copilot and Visual Studio Code allows an authorized attacker to execute code over a network.

Microsoft Entra Jira Single-Sign-On Plugin Elevation of Privilege Vulnerability

Microsoft Azure Site Recovery Elevation of Privilege Vulnerability

Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability

Improper access control in Storvsp.sys Driver allows an authorized attacker to elevate privileges locally.

Improper access control in Windows Admin Center allows an authorized attacker to elevate privileges locally.

Software for Open Networking in the Cloud (SONiC) Elevation of Privilege Vulnerability

Windows Installer Elevation of Privilege Vulnerability

Windows Address Book Remote Code Execution Vulnerability

Windows Group Policy Elevation of Privilege Vulnerability

Skype for Business Information Disclosure Vulnerability

Azure Compute Gallery Elevation of Privilege Vulnerability

Summary: As of July 8, 2025 Microsoft has completed mitigations to address this vulnerability. See KB5042562: Guidance for blocking rollback of virtualization-based security related updates and the Recommended Actions section of this CVE for guidance on how to protect your systems from this vulnerability. An elevation of privilege vulnerability exists in Windows based systems supporting Virtualization Based Security (VBS), including a subset of Azure Virtual Machine SKUS. This vulnerability enables an attacker with administrator privileges to replace current versions of Windows system files with outdated versions. By exploiting this vulnerability, an attacker could reintroduce previously mitigated vulnerabilities, circumvent some features of VBS, and exfiltrate data protected by VBS. Update: July 10, 2025 Microsoft has addressed this vulnerability for Windows 10 1507, Windows 10, version 1607, Windows 10, version 1809, and Windows Server 2016 and Windows Server 2018. This ensures that mitigations are available to protect all supported versions of Windows 10 and Windows 11 from this vulnerability. See the available mitigations and deployment guidelines described in KB5042562: Guidance for blocking rollback of virtualization-based security related updates. Update: August 13, 2024 Microsoft has released the August 2024 security updates that include an opt-in revocation policy mitigation to address this vulnerability. Customers running affected versions of Windows are encouraged to review KB5042562: Guidance for blocking rollback of virtualization-based security related updates to assess if this opt-in policy meets the needs of their environment before implementing this mitigation. There are risks associated with this mitigation that should be understood prior to applying it to your systems. Detailed information about these risks is also available in KB5042562. Details: A security researcher informed Microsoft of an elevation of privilege vulnerability in Windows 10, Windows 11, Windows Server 2016, and higher based systems including Azure Virtual Machines (VM) that support VBS. For more information on Windows versions and VM SKUs supporting VBS, reference: Virtualization-based Security (VBS) | Microsoft Learn. The vulnerability enables an attacker with administrator privileges on the target system to replace current Windows system files with outdated versions. Successful... See more at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21302

Microsoft Azure Kubernetes Service Confidential Container Remote Code Execution Vulnerability

Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.

Azure Stack Hub Elevation of Privilege Vulnerability

Improper access control in Windows Camera Frame Server Monitor allows an authorized attacker to disclose information locally.

Improper access control in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally.

Improper access control in Microsoft Windows Search Component allows an authorized attacker to deny service locally.

Improper access control in Azure Event Grid allows an unauthorized attacker to elevate privileges over a network.

Improper access control in Azure Monitor Agent allows an authorized attacker to elevate privileges locally.

Improper access control in Azure Notification Service allows an authorized attacker to elevate privileges over a network.

Improper access control in Network Connection Status Indicator (NCSI) allows an authorized attacker to elevate privileges locally.

Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.

Remote Desktop Client Remote Code Execution Vulnerability

Improper access control in Windows Storage VSP Driver allows an authorized attacker to elevate privileges locally.

Improper access control in Customer Experience Improvement Program (CEIP) allows an authorized attacker to elevate privileges locally.

Improper access control in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally.

Improper access control in Windows Error Reporting allows an authorized attacker to elevate privileges locally.

Azure Networking Elevation of Privilege Vulnerability

Azure Bot Service Elevation of Privilege Vulnerability

Improper access control in Visual Studio allows an authorized attacker to elevate privileges locally.

Dynamics 365 FastTrack Implementation Assets Information Disclosure Vulnerability

Improper access control in Windows Hyper-V allows an authorized attacker to elevate privileges locally.

Improper access control in Azure Databricks allows an unauthorized attacker to elevate privileges over a network.