CVE-2025-21199

FAQ

According to the CVSS metric, user interaction is required (UI:R). What does that mean for this vulnerability?

Successful exploitation of this vulnerability requires an administrator to install the VM agent on the target device where an attacker has planted specially crafted malicious files.

According to the CVSS metric, privileges required is low (PR:L). What does that mean for this vulnerability?

Successful exploitation of this vulnerability requires an attacker to have access to the location where the target file will be run. They would then need to plant a specific file that would be used as part of the exploitation.

What privileges could be gained by an attacker who successfully exploited this vulnerability?

An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.

According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?

Successful exploitation of this vulnerability requires an attacker to take additional actions prior to exploitation to prepare the target environment.

What are the fixed build numbers for the versions of Azure Site Recovery addressed in Update Rollup 76 for Azure Site Recovery?

**Are there any any prerequisites for installing the update?

To install Microsoft Azure Site Recovery Provider Update Rollup 76, you must have one of the following installed:

• Microsoft Azure Site Recovery Provider (version 5.23.x or a later version)
• Microsoft Azure Recovery Services Agent (version 2.0.9263.0 or a later version)