Microsoft has patched a privilege escalation vulnerability in Active Directory Domain Services, identified as CVE-2025-29810, during the April 2025 Patch Tuesday release.
Technical Overview
The vulnerability is caused by improper access control in Windows Active Directory Domain Services and falls under CWE-284: Improper Access Control. An authenticated attacker with low-level privileges on a domain-joined system can exploit the flaw to gain SYSTEM-level privileges.
- Attack Vector: Network-based
- Attack Complexity: High
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact: High (Confidentiality, Integrity, Availability)
- CVSS v3.1 Score: 7.5
- CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Systems
The vulnerability impacts systems running Windows Active Directory Domain Services. Patches have been released for most supported platforms. However, patches for the following are still pending:
- Windows 10 for x64-based Systems
- Windows 10 for 32-bit Systems
Microsoft states these patches will be released as soon as possible.
Exploitation Status
Microsoft and external researchers currently assess the exploitability as less likely due to the high attack complexity. No evidence of exploitation in the wild or public disclosure prior to the patch release has been reported.
Exploitation Requirements
To exploit CVE-2025-29810, attackers need:
- Existing low-level access on the network
- Knowledge of the target environment
- Ability to craft specific authentication requests targeting Active Directory internal mechanisms
No user interaction is needed for the exploit to succeed.
Security Recommendations
System administrators should:
- Apply all available patches immediately, especially to domain controllers.
- Monitor for anomalous authentication activity in logs and traffic.
- Apply the principle of least privilege across domain accounts.
- Track Microsoft’s release of patches for remaining Windows 10 systems.
The vulnerability was reported through coordinated disclosure by security researcher Matthieu Buffet. Microsoft has not released full technical details to reduce the risk of exploitation.
Conclusion
CVE-2025-29810 highlights the critical nature of securing core infrastructure services such as Active Directory. Timely patching and privilege management remain essential for reducing the impact of vulnerabilities in domain environments.