CVE-2025-50171

EUVD-2025-24340
Missing authorization in Remote Desktop Server allows an unauthorized attacker to perform spoofing over a network.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.1 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
microsoftCNA
9.1 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C
Base Score
CVSS 3.x
EPSS Score
Percentile: 26%
Affected Products (NVD)
VendorProductVersion
microsoftwindows_server_2022
𝑥
< 10.0.20348.3989
microsoftwindows_server_2022_23h2
𝑥
< 10.0.25398.1791
microsoftwindows_server_2025
𝑥
< 10.0.26100.4851
𝑥
= Vulnerable software versions
Windows Releases
Platform
Version
Windows 10
21H2 (arm64, x64, x86)
KB5063709
22H2 (arm64, x64, x86)
KB5063709
Windows 11
22H2 (x64)
KB5063875
23H2 (arm64, x64)
KB5063875
24H2 (arm64, x64)
KB5063878
Windows Server 2022
23H2 Server Core
KB5063899
Server Core
KB5063880
Standard
KB5063880
Windows Server 2025
Server Core
KB5063878
Standard
KB5063878
Common Weakness Enumeration
References
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-50171