CVE-2025-21391

What it actually does

CVE-2025-21391 is a Windows Storage elevation-of-privilege vulnerability associated with unsafe link following. A local attacker who can execute code on a vulnerable Windows system can abuse symbolic links, junctions, hard links, or other reparse-point behavior to influence a privileged Windows Storage operation. If the privileged component follows attacker-controlled links, it may modify, create, delete, or change permissions on files outside the intended location, potentially allowing escalation from a low-privileged user context to administrator or SYSTEM-level control.

Why it matters to the business

Successful exploitation can turn an initial foothold on a Windows endpoint or server into full local control, allowing attackers to disable security tools, access sensitive data, install persistence, and move laterally. Because this vulnerability is listed in CISA KEV and has active in-the-wild exploitation, organizations should treat remediation as urgent; CISA’s listed remediation due date was 2025-03-04. While it is not marked as ransomware-associated in KEV, privilege escalation flaws like this are commonly used after phishing, malware execution, or stolen-credential access to deepen compromise.

How an attack unfolds

An attacker first obtains the ability to run code locally on a vulnerable Windows host, usually through malware, phishing, a malicious document, remote access tooling, or compromise of a standard user account. The attacker then prepares attacker-controlled filesystem objects such as symbolic links, junctions, hard links, or reparse points in a writable location. By triggering a vulnerable Windows Storage workflow, the attacker causes a privileged Windows component to follow the crafted link and perform an operation against a protected target path. Depending on the exact exploit technique, this can result in privileged file modification, deletion, permission changes, or placement of attacker-controlled content where only elevated code should write. The attacker then leverages that privileged change to execute code as administrator or SYSTEM, establish persistence, tamper with defenses, or continue lateral movement.

How to fix it

Install the Microsoft security update that fixes CVE-2025-21391 on all affected supported Windows systems. If exact fixed builds or KBs are not centrally tracked, use Microsoft Security Update Guide and Windows Update/WSUS/Intune/SCCM compliance data to verify that February 2025 or later cumulative security updates applicable to each Windows version are installed. Prioritize internet-facing Windows systems, servers used for administration, jump hosts, VDI images, build systems, and endpoints used by privileged users. Where immediate patching is not possible, reduce exposure by limiting local interactive access, removing unnecessary local administrator rights, enforcing application control, blocking untrusted script execution, enabling tamper protection for security tools, and monitoring for suspicious link/reparse-point abuse. Mitigations should be treated as temporary because this is a KEV-listed vulnerability with active exploitation.

How to confirm the fix worked

Confirm that each Windows asset reports an installed cumulative security update or build level that includes the February 2025 security fix for its Windows release. Validate through centralized patch tooling such as WSUS, Microsoft Intune, Configuration Manager, vulnerability scanners, or EDR inventory. On individual hosts, review Windows Update history, installed hotfixes, and OS build information, then compare against Microsoft’s Security Update Guide entry for CVE-2025-21391. Re-scan after patch deployment to verify the vulnerability no longer appears. For gold images and offline templates, confirm the patched cumulative update is integrated before reuse. If compensating controls were applied, test that standard users cannot create or abuse reparse points in sensitive operational paths and that process/file telemetry records suspicious link-creation behavior.

Typical attack path

1. Gain local code execution on a vulnerable Windows machine using malware, stolen credentials, phishing, or another initial-access method.
2. Identify a writable directory or storage-related workflow that can be used to trigger the vulnerable Windows Storage behavior.
3. Create a crafted symbolic link, junction, hard link, or reparse point that redirects a privileged operation to a protected file or directory.
4. Trigger the vulnerable storage operation so the privileged Windows component follows the attacker-controlled link.
5. Use the resulting privileged file write, delete, or permission change to obtain elevated execution, commonly administrator or SYSTEM.
6. Disable defenses, install persistence, collect credentials, or move laterally from the compromised host.

How to detect it

To determine whether exploitation may have already occurred, focus on local post-compromise telemetry rather than network indicators, because this is a local privilege-escalation issue. Review EDR, Sysmon, and Windows Security logs for standard-user processes creating symbolic links, junctions, hard links, or reparse points shortly before privileged file changes or SYSTEM-level execution. Useful sources include Windows Security Event ID 4688 for process creation, Event ID 4670 for permission changes, Event ID 4663 for object access if file auditing is enabled, Service Control Manager Event ID 7045 for service creation, scheduled task logs, PowerShell Script Block logs, Sysmon Event ID 1 for process creation, Sysmon Event ID 11 for file creation, and EDR file-operation telemetry. Hunt for use of mklink, fsutil, PowerShell link-creation commands, or native APIs that create reparse points from writable user locations such as %TEMP%, %APPDATA%, Downloads, or ProgramData. Pay special attention to links that target protected locations such as C:\Windows\System32, C:\Windows\System32\drivers, C:\Program Files, service executable paths, startup folders, security-tool directories, or privileged configuration files. Correlate suspicious link activity with later elevation indicators: new local administrators, new services, new scheduled tasks, unexpected SYSTEM shells, LSASS access, security-tool tampering, driver installation, or credential dumping. Because this vulnerability is known to be exploited in the wild, suspicious local privilege-escalation artifacts should be investigated even if there is no public exploit-specific filename or network signature.

• mklink /D
• mklink /J
• mklink /H
• fsutil reparsepoint
• fsutil hardlink create
• New-Item -ItemType SymbolicLink
• New-Item -ItemType Junction
• New-Item -ItemType HardLink
• cmd.exe /c mklink
• powershell.exe New-Item -ItemType SymbolicLink
• powershell.exe New-Item -ItemType Junction
• powershell.exe New-Item -ItemType HardLink
• C:\Windows\System32\fsutil.exe
• C:\Windows\System32\cmd.exe /c mklink
• Event ID 4688 mklink
• Event ID 4688 fsutil
• Event ID 4670 permissions on C:\Windows\System32
• Event ID 7045
• Service Control Manager 7045
• C:\Windows\System32\drivers\
• C:\Windows\System32\config\
• C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
• \AppData\Local\Temp\
• \AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
• C:\Windows\Tasks\
• C:\Windows\System32\Tasks\

What your security team should do

• Patch all affected Windows systems immediately, prioritizing systems with privileged users, administrative tooling, shared servers, and high-value workloads because this vulnerability is actively exploited and KEV-listed.
• Verify compliance against the CISA KEV remediation expectation, noting the listed due date of 2025-03-04 has passed.
• Hunt for recent local privilege-escalation activity on Windows hosts, especially where suspicious link creation is followed by service installation, scheduled task creation, security-tool tampering, or SYSTEM-level process execution.
• Enable or confirm collection of Windows Security process creation events, Sysmon process/file telemetry, PowerShell logging, and EDR filesystem events for junction, symbolic link, hard link, and reparse-point abuse.
• Restrict local administrator membership, enforce least privilege, and review endpoints where standard users have broad write access to shared operational directories.
• Apply application control or attack surface reduction rules to limit untrusted scripts, LOLBins, and unsigned binaries that may be used after elevation.
• Investigate any endpoint where low-privileged users created links pointing into C:\Windows, C:\Program Files, service directories, driver directories, security-tool directories, or other protected paths.
• After remediation, perform a focused post-exploitation review for persistence mechanisms such as new services, scheduled tasks, startup-folder entries, WMI subscriptions, suspicious drivers, and altered ACLs.