CVE-2025-48799

moderate-risk

Published 2025-07-08

Improper link resolution before file access ('link following') in Windows Update Service allows an authorized attacker to elevate privileges locally.

Do I need to act?

1.8% chance of exploitation in next 30 days

EPSS score — moderate exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.8/10 High

LOCAL / LOW complexity

Windows 10 1607

Windows 10 1809

Windows 10 21H2

Windows 10 22H2

Windows 11 22H2

Windows 11 23H2

Windows 11 24H2

Windows Server 2025

Microsoft

Vendor Advisory https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-48799

Exploit https://www.vicarius.io/vsociety/posts/cve-2025-48799-detection-script-elevation...

Exploit https://www.vicarius.io/vsociety/posts/cve-2025-48799-mitigation-script-elevatio...

/ 100

moderate-risk

Severity 24/34 · High

Exploitability 5/34 · Minimal

Exposure 16/34 · Moderate