CVE-2025-53778

Think of this like a hotel where a guest with a basic room key manages to trick the front desk system into handing them a master key. On Windows, this flaw lets someone with just a normal, low-level account trick the login system into granting them full administrator powers over the computer or server.

This matters to you if you run Windows 10, Windows 11, or any of the listed Windows Server versions on machines connected to a network. It specifically threatens you if attackers (or a compromised low-level account, such as an employee's or a guest account) already have ordinary user access and network reachability to the machine — no special trickery or screen interaction is needed beyond that.

There's no confirmed sign yet that attackers are actively exploiting this in the wild, and no public exploit code has surfaced, but researchers rate the likelihood of exploitation as unusually high and attention to this flaw is increasing. Businesses should treat this as a real, near-term risk and schedule patching soon rather than treating it as routine maintenance.

Identify all Windows 10, Windows 11, and Windows Server (2008 through 2025) systems in your environment, especially those with multiple standard-user accounts or network exposure. Apply the Microsoft security update matching your exact build: Windows 10 → 10.0.10240.21100 / 10.0.14393.8330 / 10.0.17763.7678 / 10.0.19044.6216 / 10.0.19045.6216; Windows 11 → 10.0.22621.5768 / 10.0.22631.5768 / 10.0.26100.4946; Server 2008 R2 → 6.1.7601.27872; Server 2008 → 6.0.6003.23471; Server 2012 → 6.2.9200.25622; Server 2012 R2 → 6.3.9600.22725. For Server 2016/2019/2022/2025, consult the MSRC advisory for the corresponding cumulative update (not individually listed in findings). No KEV listing or confirmed exploitation currently exists, so there is no CISA remediation deadline, but EPSS is elevated and rising (99th percentile), so treat this with urgency comparable to actively-targeted flaws. As a temporary mitigation if patching must be delayed, limit NTLM authentication where possible (enforce Kerberos, restrict NTLM via group policy), and tighten privilege separation so low-privileged accounts cannot reach sensitive hosts over the network. Monitor for anomalous privilege escalation events and unexpected administrative logons following authentication from low-privileged accounts.

CVSS 3.1 score 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects network-exploitable, low-complexity privilege escalation requiring only low-privilege authentication and no user interaction, with high impact to confidentiality, integrity, and availability. Weakness type is CWE-287 (Improper Authentication) in the NTLM authentication protocol handling. Not currently in CISA's Known Exploited Vulnerabilities catalog and no public exploit code is known to exist, but EPSS places exploitation likelihood at the 99th percentile with a rising trend, and press attention is increasing — indicating high near-term risk despite the absence of confirmed in-the-wild activity.