CVE-2025-21391
Microsoft Windows Storage Link Following Vulnerability
Description
CVE-2025-21391 is a high-severity elevation of privilege vulnerability in Windows Storage, a core subsystem responsible for file system operations in Microsoft Windows. The flaw allows a locally authenticated attacker with low privileges to escalate privileges and perform unauthorized file deletion or modification operations. With a CVSS v3.1 base score of 7.1 and an EPSS score of 2.18% at the 84th percentile, this vulnerability is actively exploited in the wild. CISA has added CVE-2025-21391 to the Known Exploited Vulnerabilities catalog with a remediation deadline of March 4, 2025, making it critical to apply the February 2025 Patch Tuesday updates across all affected Windows systems.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | < 10.0.10240.20915 |
| microsoft | windows 10 1607 | < 10.0.14393.7785 |
| microsoft | windows 10 1809 | < 10.0.17763.6893 |
| microsoft | windows 10 21h2 | < 10.0.19044.5487 |
| microsoft | windows 10 22h2 | < 10.0.19045.5487 |
| microsoft | windows 11 22h2 | < 10.0.22621.4890 |
| microsoft | windows 11 23h2 | < 10.0.22631.4890 |
| microsoft | windows 11 24h2 | < 10.0.26100.3107 |
| microsoft | windows server 2016 | < 10.0.14393.7785 |
| microsoft | windows server 2019 | < 10.0.17763.6893 |
| microsoft | windows server 2022 | < 10.0.20348.3148 |
| microsoft | windows server 2022 23h2 | < 10.0.25398.1425 |
| microsoft | windows server 2025 | < 10.0.26100.3107 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21391(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-21391(US Government Resource)
Weakness Type
Elevation of Privilege in Windows Storage
CVE-2025-21391 is an elevation of privilege vulnerability in the Windows Storage subsystem. While no specific CWE has been formally assigned, the vulnerability is consistent with improper link resolution or file access control weaknesses that allow a low-privileged user to manipulate file system operations to delete or modify files beyond their normal permission scope. The Windows Storage component handles file operations at a privileged level, and a flaw in its processing logic enables an attacker to redirect or manipulate these operations to affect files they should not have access to.
Impact Analysis
CVE-2025-21391 poses a significant threat to Windows environments across enterprise and consumer deployments. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) indicates the vulnerability requires local access with low privileges and no user interaction, with high impact on integrity and availability but no direct impact on confidentiality. Confidentiality (None): The vulnerability does not directly expose sensitive data. The primary impact is on file manipulation rather than data disclosure. Integrity (High): An attacker can delete or modify critical system files, application binaries, security configurations, or audit logs. This can be leveraged to disable security controls, corrupt application installations, or create conditions for further exploitation by removing protective files or replacing system components. Availability (High): Unauthorized file deletion can render applications, services, or the entire operating system inoperable. Deletion of critical system files, driver files, or configuration databases can cause system crashes, boot failures, or denial of service for essential business applications. The EPSS score of 2.18% at the 84th percentile indicates meaningful exploitation activity. Ransomware use is currently listed as unknown, but file deletion capabilities can be leveraged as a destructive wiper component or combined with other vulnerabilities for a complete attack chain. The vulnerability affects all currently supported Windows versions from Windows 10 1507 through Windows Server 2025.
Exploit Maturity
CVE-2025-21391 exhibits confirmed active exploitation in the wild. CISA has included this vulnerability in the Known Exploited Vulnerabilities catalog, with a mandatory remediation deadline of March 4, 2025. Microsoft confirmed active exploitation in its February 2025 security update advisory. The EPSS score of 2.18% at the 84th percentile places this vulnerability in the top 16% of exploitation probability among all tracked vulnerabilities. While specific public exploit code has not been widely circulated, the confirmed active exploitation and the relative simplicity of the attack (local access, low privileges, no user interaction) indicate that reliable exploitation techniques exist among threat actors. The ability to delete arbitrary files through privilege escalation is a valuable capability for attackers, both as a standalone destructive action and as a preparatory step in multi-stage attacks. Ransomware association is currently listed as unknown.
Remediation
-
Apply the February 2025 Patch Tuesday security updates immediately. Microsoft released patches for CVE-2025-21391 as part of the February 11, 2025 security update. Install the applicable cumulative update for each affected Windows version. Refer to the Microsoft Security Response Center advisory for specific KB articles and download links for each platform.
-
Prioritize patching all affected Windows systems. The vulnerability affects Windows 10 (versions 1507 through 22H2), Windows 11 (22H2, 23H2, 24H2), and Windows Server (2016 through 2025). Ensure comprehensive patch deployment across all environments, including workstations, servers, virtual machines, and cloud-hosted Windows instances.
-
Implement file integrity monitoring. Deploy file integrity monitoring (FIM) solutions to detect unauthorized deletion or modification of critical system files, application binaries, and security configurations. Configure alerts for unexpected file system changes, particularly in Windows system directories and security-related paths.
-
Enforce least privilege and access controls. Ensure users operate with the minimum privileges necessary for their role. Remove unnecessary local administrator rights and implement application control policies to restrict the execution of potentially malicious code that could leverage this vulnerability for file deletion attacks.
-
Monitor for post-exploitation indicators. Review Windows Security event logs for unusual file deletion patterns, access denied errors followed by successful deletions, and anomalous process behavior involving Windows Storage components. Deploy endpoint detection and response (EDR) rules targeting privilege escalation through file system manipulation techniques.
Technical Details
CVE-2025-21391 is an elevation of privilege vulnerability in the Windows Storage subsystem. The CVSS v3.1 vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H indicates local access is required with low-privilege authentication, no user interaction, and the impact is limited to integrity and availability (no confidentiality impact). The scope remains unchanged. The Windows Storage subsystem manages file system operations including file creation, deletion, and modification at a privileged level. The vulnerability allows a low-privileged user to manipulate the storage subsystem's operations in a way that elevates their effective permissions for file system operations. The specific technical mechanism has not been fully disclosed by Microsoft, but the impact profile (no confidentiality impact, high integrity and availability impact) is consistent with a symlink or junction point manipulation vulnerability, where an attacker creates symbolic links or NTFS junction points that redirect privileged file operations to target arbitrary files on the system. By exploiting this class of vulnerability, an attacker operating under a standard user context can cause the Windows Storage component to delete or modify files that would normally require administrative or SYSTEM-level permissions. The affected versions encompass the full range of supported Windows platforms: Windows 10 versions 1507 through 22H2, Windows 11 versions 22H2 through 24H2, and Windows Server versions 2016 through 2025, reflecting the pervasive presence of the Windows Storage subsystem across all modern Windows releases.
Frequently Asked Questions
Is CVE-2025-21391 being actively exploited?
Yes. Microsoft has confirmed active exploitation in the wild, and CISA has added CVE-2025-21391 to the Known Exploited Vulnerabilities catalog with a remediation deadline of March 4, 2025. The EPSS score of 2.18% at the 84th percentile further confirms active targeting by threat actors.
What is the impact of CVE-2025-21391?
The vulnerability allows a low-privileged local attacker to delete or modify files that should be protected by system-level permissions. This can disable security software, corrupt critical system files, render applications inoperable, or prepare the ground for further exploitation. Notably, there is no direct confidentiality impact, meaning the vulnerability is used for file manipulation rather than data theft.
What Windows versions are affected by CVE-2025-21391?
CVE-2025-21391 affects Windows 10 (versions 1507 through 22H2), Windows 11 (22H2, 23H2, 24H2), and Windows Server (2016 through 2025). The vulnerability exists in the Windows Storage subsystem common to all these platforms.
How do I fix CVE-2025-21391?
Apply the February 2025 Patch Tuesday cumulative updates from Microsoft for your specific Windows version. Visit the Microsoft Security Response Center advisory for detailed update information and direct download links for each affected platform.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.