PT-2025-15586 · Microsoft · Windows Kerberos+1

Ceri Coburn + 1 · Published 2025-04-08 · Updated 2025-07-10 · CVE-2025-29809

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Windows Kerberos (affected versions not specified)

Description The issue is related to insecure storage of sensitive information in Windows Kerberos, allowing an authorized attacker to bypass a security feature locally. This can potentially lead to the disclosure of protected information. The vulnerability is considered critical and has a low attack complexity, meaning it can be exploited by individuals with minimal system privileges. Although there have been no confirmed exploits reported in the wild, the likelihood of exploitation is classified as 'More Likely'.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insecure Storage of Sensitive Information

Weakness Enumeration

CWE-922

Related Identifiers

BDU:2025-04111

CVE-2025-29809

Affected Products

Windows

Windows Kerberos

References · 28

• https://osv.dev/vulnerability/CVE-2025-29809 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-29809 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-29809 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29809 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-04111 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-29809 · Vendor Advisory
• https://twitter.com/CareWeDoNot/status/1910045180075389206 · Twitter Post
• https://t.me/offensivetwitter/2922 · Telegram Post
• https://reddit.com/r/CVEWatch/comments/1k2cptw/top_10_trending_cves_18042025 · Reddit Post
• https://t.me/cvenotify/128360 · Telegram Post
• https://twitter.com/windowsforum/status/1909661499687051431 · Twitter Post
• https://t.me/purp_sec/523 · Telegram Post
• https://netspi.com/blog/technical-blog/adversary-simulation/cve-2025-21299-cve-2025-29809-unguarding-microsoft-credential-guard · Note
• https://reddit.com/r/CVEWatch/comments/1k262t8/top_10_trending_cves_18042025 · Reddit Post
• https://t.me/avleonovcom/1524 · Telegram Post