PT-2025-18299 · Microsoft · Azure Virtual Desktop

Published 2025-04-30 · Updated 2025-05-01 · CVE-2025-21416

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Azure Virtual Desktop (affected versions not specified)

Description The issue is related to missing authorization in Azure Virtual Desktop, which allows an authorized attacker to elevate privileges over a network.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-21416

Affected Products

Azure Virtual Desktop

References · 7

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21416 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-21416 · Security Note
• https://twitter.com/vulns_space/status/1917653654284235082 · Twitter Post
• https://t.me/cvetracker/22733 · Telegram Post
• https://t.me/msrcreports/2007 · Telegram Post
• https://twitter.com/cybercronai/status/1917946023349031260 · Twitter Post
• https://twitter.com/CVEnew/status/1917633198114095555 · Twitter Post