CVE-2025-21322
📋 TL;DR
Microsoft PC Manager contains an elevation of privilege vulnerability (CWE-59) that allows authenticated attackers to gain SYSTEM-level privileges on affected systems. This affects users running vulnerable versions of Microsoft PC Manager on Windows systems. Attackers must already have local access to exploit this vulnerability.
💻 Affected Systems
- Microsoft PC Manager
📦 What is this software?
Pc Manager by Microsoft
⚠️ Risk & Real-World Impact
Worst Case
Attacker gains full SYSTEM privileges, enabling complete system compromise, data theft, persistence establishment, and lateral movement capabilities.
Likely Case
Privileged user or malware with initial access escalates to SYSTEM to bypass security controls, install additional malware, or access protected resources.
If Mitigated
Limited impact due to layered defenses, but still enables privilege escalation within the compromised system.
🎯 Exploit Status
Requires authenticated user access. Exploitation involves improper link resolution (CWE-59).
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Latest security update from Microsoft
Vendor Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21322
Restart Required: No
Instructions:
1. Open Windows Update settings. 2. Check for updates. 3. Install all available security updates. 4. Verify Microsoft PC Manager is updated to latest version.
🔧 Temporary Workarounds
Disable Microsoft PC Manager
WindowsUninstall or disable Microsoft PC Manager to remove attack surface
winget uninstall Microsoft.PCManager
Restrict local user privileges
allImplement least privilege principle to limit initial access
🧯 If You Can't Patch
- Implement application allowlisting to prevent unauthorized process execution
- Enable Windows Defender Application Control or similar solutions
🔍 How to Verify
Check if Vulnerable:
Check Microsoft PC Manager version and compare against patched version in advisoryCheck Version:
winget show Microsoft.PCManagerVerify Fix Applied:
Verify Windows Update history shows security update installed and PC Manager version is updated📡 Detection & Monitoring
Log Indicators:
- Unexpected SYSTEM privilege processes spawned from user context
- Microsoft PC Manager process anomalies
Network Indicators:
- None - local exploitation only
SIEM Query:
Process Creation where ParentImage contains 'pcmanager.exe' and IntegrityLevel='System'