CVE-2025-59512 | THREATINT

Description

Improper access control in Customer Experience Improvement Program (CEIP) allows an authorized attacker to elevate privileges locally.

PUBLISHED Reserved 2025-09-17 | Published 2025-11-11 | Updated 2025-11-26 | Assigner microsoft

HIGH: 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Problem types

CWE-284: Improper Access Control

Product status

10.0.17763.0 (custom) before 10.0.17763.8027

affected

10.0.17763.0 (custom) before 10.0.17763.8027

affected

10.0.17763.0 (custom) before 10.0.17763.8027

affected

10.0.20348.0 (custom) before 10.0.20348.4405

affected

10.0.19044.0 (custom) before 10.0.19044.6575

affected

10.0.19045.0 (custom) before 10.0.19045.6575

affected

10.0.26100.0 (custom) before 10.0.26100.7171

affected

10.0.26200.0 (custom) before 10.0.26200.7171

affected

10.0.22631.0 (custom) before 10.0.22631.6199

affected

10.0.22631.0 (custom) before 10.0.22631.6199

affected

10.0.25398.0 (custom) before 10.0.25398.1965

affected

10.0.26100.0 (custom) before 10.0.26100.7171

affected

10.0.26100.0 (custom) before 10.0.26100.7171

affected

10.0.14393.0 (custom) before 10.0.14393.8594

affected

10.0.14393.0 (custom) before 10.0.14393.8594

affected

10.0.14393.0 (custom) before 10.0.14393.8594

affected

6.2.9200.0 (custom) before 6.2.9200.25768

affected

6.2.9200.0 (custom) before 6.2.9200.25768

affected

6.3.9600.0 (custom) before 6.3.9600.22869

affected

6.3.9600.0 (custom) before 6.3.9600.22869

affected

References

www.vicarius.io/...vulnerability-affecting-ceip-by-microsoft

msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59512 (Customer Experience Improvement Program (CEIP) Elevation of Privilege Vulnerability) vendor-advisory

cve.org (CVE-2025-59512)

nvd.nist.gov (CVE-2025-59512)

Download JSON