CVE-2025-21360
📋 TL;DR
This vulnerability in Microsoft AutoUpdate allows local attackers to escalate privileges on affected macOS systems. An authenticated attacker could exploit this to gain root privileges, potentially compromising the entire system. Only macOS systems running Microsoft AutoUpdate are affected.
💻 Affected Systems
- Microsoft AutoUpdate for macOS
📦 What is this software?
Autoupdate by Microsoft
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with root access, enabling installation of persistent malware, data theft, and lateral movement across the network.
Likely Case
Local privilege escalation allowing attackers to bypass security controls, install unauthorized software, and access sensitive system resources.
If Mitigated
Limited impact if proper privilege separation and least privilege principles are already implemented.
🎯 Exploit Status
Requires local access and user-level privileges to exploit. No public exploit code available at this time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Microsoft AutoUpdate 4.90.24080.01 or later
Vendor Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21360
Restart Required: No
Instructions:
1. Open Microsoft AutoUpdate on macOS. 2. Check for updates. 3. Install version 4.90.24080.01 or later. 4. Verify the update completed successfully.
🔧 Temporary Workarounds
Disable Microsoft AutoUpdate
macOSTemporarily disable Microsoft AutoUpdate to prevent exploitation while planning for patching
sudo launchctl unload /Library/LaunchDaemons/com.microsoft.autoupdate.helper.plist
sudo launchctl unload /Library/LaunchAgents/com.microsoft.update.agent.plist
🧯 If You Can't Patch
- Implement strict privilege separation and least privilege principles for all user accounts
- Monitor for suspicious privilege escalation attempts using endpoint detection tools
🔍 How to Verify
Check if Vulnerable:
Check Microsoft AutoUpdate version in About Microsoft AutoUpdate dialog or via command lineCheck Version:
defaults read /Library/Preferences/com.microsoft.autoupdate2.plist VersionVerify Fix Applied:
Verify Microsoft AutoUpdate version is 4.90.24080.01 or higher📡 Detection & Monitoring
Log Indicators:
- Unexpected privilege escalation events
- Microsoft AutoUpdate process spawning with elevated privileges
- Unauthorized changes to system files
Network Indicators:
- Unusual outbound connections from Microsoft AutoUpdate processes
SIEM Query:
process_name:"Microsoft AutoUpdate" AND event_type:"privilege_escalation"