CVE-2025-21311 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	9.8 CRITICAL	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 81.37%

Affected Products (NVD)

Vendor	Product	Version
microsoft	windows_11_24h2	𝑥 < 10.0.26100.2894
microsoft	windows_server_2022_23h2	𝑥 < 10.0.25398.1369
microsoft	windows_server_2025	𝑥 < 10.0.26100.2894

𝑥

= Vulnerable software versions

Windows Releases

Platform

Version

Windows 11

24H2 (arm64, x64)

Windows Server 2022

23H2 Server Core

Windows Server 2025

Server Core	KB5050009
Standard	KB5050009

Debian Releases

Debian Product

Codename

squid

bookworm	no-dsa
bookworm (security)	vulnerable
bullseye	postponed
bullseye (security)	vulnerable
forky	7.6-2 fixed
sid	7.6-2 fixed
trixie	ignored
trixie (security)	vulnerable

Ubuntu Releases

Ubuntu Product

Codename

squid

focal	ignored
jammy	ignored
noble	ignored
plucky	ignored

squid3

bionic	ignored
jammy	dne
noble	dne
plucky	dne
xenial	ignored

Common Weakness Enumeration

CWE-303 - Incorrect Implementation of Authentication Algorithm
The requirements for the software dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect.

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21311