Skip to content

CVE-2025-21391 — Windows Storage Privilege Escalation

Key facts

CVE-2025-21391 is a Critical vulnerability: Windows Storage Privilege Escalation. This entry ships a detection-only PoC. It is on the CISA Known Exploited Vulnerabilities (KEV) catalog (added 2025-02-11), confirming active exploitation in the wild.

Actively exploited — on the CISA KEV catalog

CVE-2025-21391 is listed on the CISA Known Exploited Vulnerabilities (KEV) catalog (added 2025-02-11), confirming exploitation in the wild. Federal remediation deadline: 2025-03-04. Prioritise patching and deploy the detection and prevention rules below.
CVE CVE-2025-21391
Severity Critical
CISA KEV Actively exploited (added 2025-02-11)
Detection / prevention —
PoC poc.py
Source 2025/CVE-2025-21391/

Details

Overview

Storage privilege escalation

Details

  • CVE ID: CVE-2025-21391
  • CVSS Score: 9.8 (Critical)
  • Type: Privilege Escalation
  • Product: Windows Storage

Usage

python3 poc.py -t https://target -c

References

Frequently asked questions

What is CVE-2025-21391?

CVE-2025-21391 is a Critical vulnerability: Windows Storage Privilege Escalation. This entry ships a detection-only PoC. It is on the CISA Known Exploited Vulnerabilities (KEV) catalog (added 2025-02-11), confirming active exploitation in the wild.

How do I detect CVE-2025-21391?

Run the detection-only PoC included with this entry against your Docker test lab to confirm whether a target is affected; pair it with your own IDS logging.

How do I block or mitigate CVE-2025-21391?

Upgrade to a fixed version per the vendor advisory; the NVD record lists the affected versions. Use the included PoC to verify your remediation.

Is CVE-2025-21391 actively exploited?

Yes. CVE-2025-21391 is on the CISA Known Exploited Vulnerabilities (KEV) catalog, added 2025-02-11, which means it has been exploited in the wild. CISA set a federal remediation deadline of 2025-03-04. Prioritise patching and deploy the detection and prevention rules above.

For authorized security testing and research only. See the full source and NVD record.