CVE-2025-21335 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: OTHER

CVE Published: 2025-01-14

Added to CISA KEV: 2025-01-14 0 DAY BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity
Apply Microsoft security updates immediately for all affected Windows systems
Monitor for unusual privilege escalation activities and unauthorized administrative access
Review Hyper-V host security and guest VM isolation
Implement principle of least privilege to limit impact of successful privilege escalation
HIGH patch priority due to active exploitation despite local attack vector

🔍 Web Intelligence (Kagi · 2026-06-04)

CVE-2025-21335 is a critical security vulnerability affecting the Windows Hyper-V NT Kernel Integration Virtual Service Provider (VSP) ^[1] ^[2].

The following details summarize what is known about this vulnerability:

Active Exploitation and Threat Actor Usage

Active Exploitation: Yes, CVE-2025-21335 has been identified as being actively exploited by threat actors in the wild ^[1].
CISA Status: Due to evidence of active exploitation, this vulnerability was added to the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) Catalog ^[3].

Attack Method and Requirements

Vulnerability Type: Elevation of Privilege (EoP) ^[1] ^[2].
Access Requirements: Successful exploitation typically requires the attacker to already have local access to the Hyper-V host ^[2].
User Interaction: There is no specific indication that user interaction is required for the exploit itself, as it targets a system-level service provider component ^[2].

Impact

System Impact: Successful exploitation allows an attacker to escalate their privileges to `SYSTEM` level ^[4] ^[2].
Consequences: Once `SYSTEM` privileges are achieved, an attacker can execute arbitrary code, access sensitive data, and potentially move closer to escaping the virtual machine or gaining full control of the host system ^[4] ^[5].

Exploit Availability and Campaigns

Proof-of-Concept: While the vulnerability is known to be exploited in the wild, specific public proof-of-concept (PoC) code is generally not shared in official advisories to prevent further abuse.
Campaigns: While it is confirmed that threat actors are using this in the wild, specific details linking it to named ransomware groups or specific targeted campaigns are not explicitly detailed in the available public security advisories beyond the general warning to patch immediately ^[1].

Patch and Mitigation Status

Patch Status: Microsoft has released security updates to address this vulnerability ^[2].
Recommendation: Organizations are strongly advised to apply the relevant security updates immediately, as the vulnerability is actively exploited and listed in the CISA KEV catalog ^[3].

Sources

Patch Tuesday January 2025 | Immersive Community - 1392
This vulnerability, while Microsoft has said the exploitation is less likely, might be an opportunity for threat actors to take advantage of the newer remote ... CVE-2025-21335 - 7.8 - Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege. Top of the list for patches to apply in the first…
CVE-2025-21335 Description, Impact and Technical Details
CVE-2025-21335 is a newly disclosed vulnerability affecting the Windows Hyper-V NT Kernel Integration Service. This issue represents an Elevation of Privilege (EoP) vulnerability, allowing an attacker with local access to a Hyper-V host to gain system-level privileges. By exploiting a flaw in the Vi…
CVE-2025-21335 Detail - NVD
CVE-2025-21335 Detail · Description · Metrics · References to Advisories, Solutions, and Tools · This CVE is in CISA's Known Exploited Vulnerabilities Catalog.
CVE-2025-21335 | High Vulnerability in Microsoft Windows Hyper-V
This vulnerability allows local attackers to elevate their privileges, potentially leading to unauthorized access to sensitive system resources. ... Risk & Impact Analysis The real-world risk associated with CVE-2025-21335 is significant, particularly for organizations that rely heavily on Microsoft…
CVE-2025-21335 - Exploiting Windows Hyper-V NT Kernel ... - cve.news
- Microsoft Security Advisory (CVE-2025-21335) - Official Patch Information - Additional Technical Writeup (if/when published) Conclusion CVE-2025-21335 is a real threat for all users of Hyper-V. The bug might look trivial, but the consequences are huge—letting bad actors run code as SYSTEM or move…

🟢 CVE-2025-21335