CVE-2025-21204
published 2025-04-08CVE-2025-21204: Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.
PriorityP353high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
6.78%
93.2th percentile
Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.
Affected
47 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | windows_10_1507 | < 10.0.10240.20978 | 10.0.10240.20978 |
| microsoft | windows_10_1607 | < 10.0.14393.7969 | 10.0.14393.7969 |
| microsoft | windows_10_1809 | < 10.0.17763.7136 | 10.0.17763.7136 |
| microsoft | windows_10_21h2 | < 10.0.19044.5737 | 10.0.19044.5737 |
| microsoft | windows_10_22h2 | < 10.0.19045.5737 | 10.0.19045.5737 |
| microsoft | windows_10_version_1507 | >= 10.0.10240.0 < 10.0.10240.20978 | 10.0.10240.20978 |
| microsoft | windows_10_version_1607 | >= 10.0.14393.0 < 10.0.14393.7969 | 10.0.14393.7969 |
| microsoft | windows_10_version_1809 | >= 10.0.17763.0 < 10.0.17763.7136 | 10.0.17763.7136 |
| microsoft | windows_10_version_21h2 | >= 10.0.19044.0 < 10.0.19044.5737 | 10.0.19044.5737 |
| microsoft | windows_10_version_22h2 | >= 10.0.19045.0 < 10.0.19045.5737 | 10.0.19045.5737 |
| microsoft | windows_11_22h2 | < 10.0.22621.5189 | 10.0.22621.5189 |
| microsoft | windows_11_23h2 | < 10.0.22631.5189 | 10.0.22631.5189 |
| microsoft | windows_11_24h2 | < 10.0.26100.3775 | 10.0.26100.3775 |
| microsoft | windows_11_version_22h2 | >= 10.0.22621.0 < 10.0.22621.5189 | 10.0.22621.5189 |
| microsoft | windows_11_version_22h3 | >= 10.0.22631.0 < 10.0.22631.5189 | 10.0.22631.5189 |
| microsoft | windows_11_version_23h2 | >= 10.0.22631.0 < 10.0.22631.5189 | 10.0.22631.5189 |
| microsoft | windows_11_version_24h2 | >= 10.0.26100.0 < 10.0.26100.3775 | 10.0.26100.3775 |
| microsoft | windows_server_2008 | — | — |
| microsoft | windows_server_2008_r2_service_pack_1 | >= 6.1.7601.0 < 6.1.7601.27670 | 6.1.7601.27670 |
| microsoft | windows_server_2008_service_pack_2 | >= 6.0.6003.0 < 6.0.6003.23220 | 6.0.6003.23220 |
| microsoft | windows_server_2012 | — | — |
| microsoft | windows_server_2012 | >= 6.2.9200.0 < 6.2.9200.25423 | 6.2.9200.25423 |
| microsoft | windows_server_2012_r2 | >= 6.3.9600.0 < 6.3.9600.22523 | 6.3.9600.22523 |
| microsoft | windows_server_2016 | < 10.0.14393.7969 | 10.0.14393.7969 |
| microsoft | windows_server_2016 | >= 10.0.14393.0 < 10.0.14393.7969 | 10.0.14393.7969 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_msrc7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-429q-ccqc-32wq: Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally
ghsa_unreviewed·2025-04-08
CVE-2025-21204 [HIGH] CWE-59 GHSA-429q-ccqc-32wq: Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally
Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.
Microsoft
Windows Process Activation Elevation of Privilege Vulnerability
vendor_msrc·2025-04-08·CVSS 7.8
CVE-2025-21204 [HIGH] CWE-59 Windows Process Activation Elevation of Privilege Vulnerability
Windows Process Activation Elevation of Privilege Vulnerability
Description: Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.
FAQ: Are the updates for Windows 10 for x64-based Systems and Windows 10 for 32-bit Systems currently available?
Yes. As of April 9, 2025, the security update (5055547) for Windows 10 for x64-based Systems and Windows 10 for 32-bit Systems are available. Customers running Windows 10 should ensure the update is installed to be protected from this vulnerability.
FAQ: How could an attacker exploit this vulnerability?
An authenticated attacker who successfully exploits this vulnerability gains the ability to perform and/or manipulate file management operations on the vi
No detection rules found.
No public exploits indexed.
Bleepingcomputer
Microsoft shares script to restore inetpub folder you shouldn’t delete
blogs_bleepingcomputer·2025-06-06·CVSS 7.8
CVE-2025-21204 [HIGH] Microsoft shares script to restore inetpub folder you shouldn’t delete
## Microsoft shares script to restore inetpub folder you shouldn’t delete
## Sergiu Gatlan
Once IIS is installed, a new inetpub folder will be added to the root of the C:\ drive, with files and the same SYSTEM ownership as the directory created by the April Windows security updates. Also, if you don't use IIS, you can uninstall it using the same Windows Features control panel to remove it, leaving the C:\inetpub folder behind.
On Wednesday, in a new update to the CVE-2025-21204 advisory, the company also shared a remediation script that helps admins re-create this folder from a PowerShell shell using the following commands:
Install-Script -Name Set-InetpubFolderAcl
C:\Program` Files\WindowsPowerShell\Scripts\Set-InetpubFolderAcl.ps1
As Redmond explains, the script will set the correc
Bleepingcomputer
Windows "inetpub" security fix can be abused to block future updates
blogs_bleepingcomputer·2025-04-25·CVSS 7.8
CVE-2025-21204 [HIGH] Windows "inetpub" security fix can be abused to block future updates
## Windows "inetpub" security fix can be abused to block future updates
## Lawrence Abrams
In an update to a security advisory , Microsoft later confirmed that the C:\inetpub folder was part of a fix for a Windows Process Activation elevation of privilege vulnerability tracked as CVE-2025-21204, with the company warning not to delete the folder .
"After installing the updates listed in the Security Updates table for your operating system, a new %systemdrive%\inetpub folder will be created on your device," confirmed Microsoft .
"This folder should not be deleted regardless of whether Internet Information Services (IIS) is active on the target device. This behavior is part of changes that increase protection and does not require any action from IT admins and end users."
However, cyberse
Bleepingcomputer
Microsoft: Windows 'inetpub' folder created by security fix, don’t delete
blogs_bleepingcomputer·2025-04-11·CVSS 7.8
[HIGH] Microsoft: Windows 'inetpub' folder created by security fix, don’t delete
## Microsoft: Windows 'inetpub' folder created by security fix, don’t delete
## Sergiu Gatlan
BleepingComputer has confirmed this behavior on our Windows 11 and Windows 10 systems and discovered that the cumulative update creates the folder using the SYSTEM account.
Even though deleting the folder did not cause issues using Windows in our tests, Microsoft told BleepingComputer on Thursday that this empty folder had been intentionally created and should not be removed.
However, according to user reports , the April cumulative updates will fail to install if the C:\inetpub directory is created before update deployment.
## Users warned not to remove the new folder
While Redmond still has to explain why the security updates are creating this folder in the first place, the company updated
Bleepingcomputer
Microsoft April 2025 Patch Tuesday fixes exploited zero-day, 134 flaws
blogs_bleepingcomputer·2025-04-08·CVSS 7.8
[HIGH] Microsoft April 2025 Patch Tuesday fixes exploited zero-day, 134 flaws
## Microsoft April 2025 Patch Tuesday fixes exploited zero-day, 134 flaws
## Lawrence Abrams
49 Elevation of Privilege Vulnerabilities
9 Security Feature Bypass Vulnerabilities
31 Remote Code Execution Vulnerabilities
17 Information Disclosure Vulnerabilities
14 Denial of Service Vulnerabilities
3 Spoofing Vulnerabilities
The above numbers do not include Mariner flaws and 13 Microsoft Edge vulnerabilities fixed earlier this month.
To learn more about the non-security updates released today, you can review our dedicated articles on the Windows 11 KB5055523 & KB5055528 cumulative updates and the Windows 10 KB5055518 update .
## One actively exploited zero-days
This month's Patch Tuesday fixes one actively exploited zero-day. Microsoft classifies a zero-day flaw as publicly disclos
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21204https://www.vicarius.io/vsociety/posts/cve-2025-21204-privilege-elevation-vulnerability-in-microsoft-windows-update-stack-detection-scripthttps://www.vicarius.io/vsociety/posts/cve-2025-21204-privilege-elevation-vulnerability-in-microsoft-windows-update-stack-mitigation-script
2025-04-08
Published