CVE-2025-21309

—

CVSS 3.1

8.1 high

EPSS

15%p97

Published

Jan 14, 2025 (Jan 14, 2025)

Modified

Jun 17, 2026

Description

Windows Remote Desktop Services Remote Code Execution Vulnerability

Vendors: microsoft
Products: windows server 2012, windows server 2016, windows server 2019, windows server 2022, windows server 2022 23h2, windows server 2025
Weakness: CWE-591
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (15.0%)

In the news3 stories

RDP: a Double-Edged Sword for IT Teams

The Hacker NewsFeb 28, 14:23 UTC · Feb 28, 2025Ransomware CVE-2025-21309 CVE-2025-21297

60

Microsoft Patch Tuesday updates for January 2025 fixed three actively exploited flaws

Security AffairsJan 15, 21:45 UTC · Jan 15, 2025Vulnerability in the wildCVE-2025-21333 CVE-2025-21334 CVE-2025-21335+3 CVEs

60

Microsoft Patch Tuesday for January 2025 — Snort rules and prominent vulnerabilities

Cisco TalosJan 14, 21:15 UTC · Jan 14, 2025Vulnerability CVE-2025-21309 CVE-2025-21298 CVE-2025-21294+22 CVEs

60