What is the CVSS score of EUVD-2025-20623?

EUVD-2025-20623 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

How to fix or mitigate EUVD-2025-20623?

Within 24 hours: Identify all Windows systems in your environment and assess which are running affected versions. Within 7 days: Apply the latest Windows security updates from Microsoft that address CVE-2025-49723 to all systems. Within 30 days: Complete patch deployment across all Windows endpoints and verify through vulnerability scanning that the fix is applied.

Windows EUVD-2025-20623

Q: Which versions of Windows are affected by EUVD-2025-20623?

CVE-2025-49723 is a local privilege escalation vulnerability in Windows StateRepository API that allows authenticated users to bypass authorization controls and tamper with system state.. A patch is available.

| CVE-2025-49723 HIGH

Missing Authorization (CWE-862)

2025-07-08 secure@microsoft.com

Windows Authentication Bypass Microsoft Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 22h2 Windows 11 23h2 Windows 11 24h2 Windows Server 2019 Windows Server 2022 Windows Server 2022 23h2 Windows Server 2025

8.8

CVSS 3.1 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-862 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V8 - Authorization Authorization checks on every request MITRE ATT&CK 1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Impact	CVSS score of 8.8 (HIGH).

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 16, 2026

Missing authorization in Windows StateRepository API allows an authorized attacker to perform tampering locally.

Earlier versions of this analysis (1)

v1 Mar 16, 2026 - 04:21 CVSS 8.8

RemediationAI

Monitor vendor advisories for patches. Apply mitigations such as network segmentation, access restrictions, and monitoring.

Affected VersionsENISA

Windows Server 2025 10.0.26100.0 <10.0.26100.4652

Windows Server 2019 10.0.17763.0 <10.0.17763.7558

Windows 11 Version 24H2 10.0.26100.0 <10.0.26100.4652

Windows Server 2019 (Server Core installation) 10.0.17763.0 <10.0.17763.7558

Windows Server 2022 10.0.20348.0 <10.0.20348.3932

Windows 10 Version 1809 10.0.17763.0 <10.0.17763.7558

Windows Server 2025 (Server Core installation) 10.0.26100.0 <10.0.26100.4652

Windows 11 version 22H3 10.0.22631.0 <10.0.22631.5624

Windows 11 Version 23H2 10.0.22631.0 <10.0.22631.5624

Windows 10 Version 22H2 10.0.19045.0 <10.0.19045.6093

Windows 10 Version 21H2 10.0.19044.0 <10.0.19044.6093

Windows 11 version 22H2 10.0.22621.0 <10.0.22621.5624

Windows Server 2022, 23H2 Edition (Server Core installation) 10.0.25398.0 <10.0.25398.1732

Affected Packages

euvd windows_10_version_1809 fix: 10.0.17763.7558

euvd windows_10_version_21h2 fix: 10.0.19044.6093

euvd windows_10_version_22h2 fix: 10.0.19045.6093

euvd windows_11_version_22h2 fix: 10.0.22621.5624

euvd windows_11_version_22h3 fix: 10.0.22631.5624

euvd windows_11_version_23h2 fix: 10.0.22631.5624

euvd windows_11_version_24h2 fix: 10.0.26100.4652

euvd windows_server_2019 fix: 10.0.17763.7558

euvd windows_server_2019_server_core_installation fix: 10.0.17763.7558

euvd windows_server_2022 fix: 10.0.20348.3932

euvd windows_server_2022_23h2_edition_server_core_installation fix: 10.0.25398.1732

euvd windows_server_2025 fix: 10.0.26100.4652

euvd windows_server_2025_server_core_installation fix: 10.0.26100.4652

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 13 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

This vulnerability is classified as Missing Authorization (CWE-862).

Know when Windows gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 8.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:29 EUVD-patch-fix

executive summary

Patch available

Apr 16, 2026 - 05:29 EUVD

10.0.26100.4652,10.0.17763.7558,10.0.20348.3932

CVE Published

Jul 08, 2025 - 17:16 nvd

HIGH 8.8

Executive ViewAI

Why It Matters

CVE-2025-49723 is a local privilege escalation vulnerability in Windows StateRepository API that allows authenticated users to bypass authorization controls and tamper with system state. This affects all Windows systems and could enable attackers with local access to compromise system integrity and escalate privileges.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.1%

Top 79% exploitable

Data Quality

4 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.1%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Small

Automatable· derived

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +44

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

More in Windows

View all

CVE-2025-52691 CRITICAL Emergency POC

10.0 Dec 29

Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio

CVE-2019-0803 HIGH Act Now POC

7.8 Apr 09

Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in

CVE-2020-1472 MEDIUM Act Now POC

5.5 Aug 17

A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr

CVE-2025-33053 HIGH Act Now POC

8.8 Jun 10

Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables

CVE-2025-33073 HIGH Act Now POC

8.8 Jun 10

Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker

CVE-2013-10047 CRITICAL Emergency POC

9.3 Aug 01

An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote

CVE-2012-10030 CRITICAL Emergency POC

9.3 Aug 05

FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit

CVE-2025-34101 CRITICAL Emergency POC

9.3 Jul 10

Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio

CVE-2025-34095 CRITICAL Emergency POC

9.3 Jul 10

Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/

CVE-2025-11953 CRITICAL Act Now POC

9.8 Nov 03

React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo

CVE-2026-96951 HIGH Act Now POC

8.8 Oct 13

Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then

CVE-2025-24054 MEDIUM This Month POC

6.5 Mar 11

External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network

Same weakness CWE-862 – Missing Authorization

View all

CVE-2023-52163 HIGH POC

8.8

CVE-2025-6205 CRITICAL POC

9.1

CVE-2025-20362 HIGH POC

8.6

CVE-2017-9232 CRITICAL POC

9.8

CVE-2023-6875 CRITICAL POC

9.8

CVE-2024-4898 CRITICAL POC

9.8

CVE-2023-32117 CRITICAL POC

9.8

CVE-2020-36719 CRITICAL POC

9.8

Same technique Authentication Bypass

View all

CVE-2015-3306 CRITICAL POC

10.0

CVE-2023-22515 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2013-2465 CRITICAL POC

9.8

CVE-2011-3544 CRITICAL POC

9.8

CVE-2022-40684 CRITICAL POC

9.8

CVE-2025-61882 CRITICAL POC

9.8

CVE-2024-0012 CRITICAL POC

9.3

References

Advisories & patches

ADVISORY https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49723 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-49723

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back