What is the CVSS score of CVE-2025-32724?

CVE-2025-32724 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 28.3%.

Which versions of Windows 10 21h2 are affected by CVE-2025-32724?

CVE-2025-32724 is a high-severity denial-of-service vulnerability in Windows LSASS that allows remote attackers to crash authentication services on affected servers without credentials, rendering…. A patch is available.

How to fix or mitigate CVE-2025-32724?

Within 24 hours: Identify all Windows servers running affected versions and assess criticality (prioritize domain controllers, VPN gateways, and authentication servers). Within 7 days: Apply Microsoft's vendor-released patch to all non-critical systems and schedule maintenance windows for critical infrastructure. Within 30 days: Complete patching of all remaining systems; implement network segmentation to restrict unauthenticated remote access to LSASS-dependent services as interim protection.

Windows 10 21h2 CVE-2025-32724

EUVD-2025-17789 HIGH

Uncontrolled Resource Consumption (CWE-400)

2025-06-10 secure@microsoft.com

Microsoft Authentication Bypass Windows 10 21h2 Windows Server 2012 Windows 11 24h2 Windows Server 2022 Windows 10 1809 Windows 10 1507 Windows Server 2008 Windows 11 23h2 Windows Server 2022 23h2 Windows 10 1607 Windows Server 2016 Windows 11 22h2 Windows Server 2025 Windows Server 2019 Windows 10 22h2 Windows

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:42 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

10.0.19044.5965,10.0.22631.5472,10.0.26100.4349

EUVD ID Assigned

Mar 14, 2026 - 19:49 euvd

EUVD-2025-17789

Analysis Generated

Mar 14, 2026 - 19:49 vuln.today

CVE Published

Jun 10, 2025 - 17:22 nvd

HIGH 7.5

DescriptionCVE.org

Uncontrolled resource consumption in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network.

AnalysisAI

Windows Local Security Authority Subsystem Service (LSASS) contains an uncontrolled resource consumption vulnerability that allows unauthenticated remote attackers to cause a denial of service. Crashing or degrading LSASS disrupts all authentication and authorization on the affected Windows server, effectively taking the system offline.

Technical ContextAI

LSASS handles all authentication and authorization decisions on Windows systems. An uncontrolled resource consumption flaw allows a remote attacker to exhaust LSASS resources, causing the service to become unresponsive. When LSASS fails, the system cannot process logons, validate Kerberos tickets, or enforce security policies, effectively denying all access to the machine.

RemediationAI

Apply the Microsoft security update. Implement network segmentation to restrict access to LSASS-exposed ports on domain controllers. Monitor LSASS resource usage for anomalies. Ensure multiple domain controllers for redundancy.