CVE-2025-21391 is a storage link following vulnerability in Microsoft Windows. CISA added it to the Known Exploited Vulnerabilities catalogue on 11 February 2025, which means attackers have used it in real attacks. Microsoft Windows Storage contains a link following vulnerability that could allow for privilege escalation.
What the vulnerability means
A storage link following flaw in Windows means the operating system can be tricked into resolving a link or reparse point in an unsafe way, so code that was supposed to act on one location may end up operating on a different, more privileged target. In a Windows context, that is dangerous because the attacker may be able to turn an ordinary file or storage interaction into elevated access.
This is the same broad weakness class that underlies many path and link-following issues: the security boundary is not the file name alone, but the object the path ultimately resolves to. When that resolution can be influenced during processing, an attacker can sometimes redirect trusted software into touching protected files, writing where it should not, or performing actions with higher privileges than intended.
Why Windows link-following flaws become privilege problems
Windows storage components often run inside trusted services, installers, management tools, or maintenance workflows. If one of those workflows follows a link that an attacker can place or swap, the result can be privilege escalation, because the action is still being carried out by a trusted process. The danger is not just data access, but the ability to cross from a low-privilege context into a higher-privilege one.
That makes this vulnerability class especially important on systems where multiple users, services, or automated tasks share storage paths. A successful exploit can turn a file-operation bug into a local escalation path, and in a larger environment that can become a stepping stone for broader compromise.
How organisations confirm exposure
Exposure review should start with asset inventory and role inventory: identify which Windows endpoints, servers, and management hosts are running the affected storage components or any software that relies on them. Then check whether those systems are reachable by untrusted users, exposed through remote administration, or used by higher-privilege services that touch attacker-controlled paths.
For authoritative version and patch details, use the vendor advisory and the CVE Program entry together with the NIST National Vulnerability Database. Those sources help confirm whether a given asset is in scope without relying on secondary writeups.
Detection, remediation, and recovery
The practical response is to patch first, then look for signs that the flaw was abused before remediation. If patching cannot happen immediately, reduce exposure by limiting who can create or modify links in sensitive locations, tightening permissions on writable directories, and reducing the number of privileged processes that operate on attacker-influenced storage paths. In parallel, review audit logs for unusual file operations, unexpected path resolution behavior, and privileged processes touching locations they should not normally reach.
Post-patch review matters because a privilege-escalation flaw may have been used to stage persistence, alter security tooling, or plant follow-on payloads. Where exploitation is suspected, review privileged local accounts, scheduled tasks, service settings, and any files or registry locations that could have been modified through the elevated path.
NHIMG’s Vulnerability Management Guide is useful here because this kind of issue should be prioritized as a known exploited vulnerability, not treated as a routine backlog item.
Risk and Threat Considerations
This vulnerability class is dangerous because link-following bugs often turn a small control failure into a privilege boundary break. Once an attacker can redirect a trusted Windows storage operation, the same flaw can support local escalation, persistence, or later movement through the host.
Failure mechanism: The attacker places or manipulates a link so that a privileged process resolves an intended path to an attacker-chosen target, then uses that trusted action to gain higher access or change protected state.
Impact: Successful exploitation can expose sensitive files, alter protected system state, enable further compromise, and give the attacker a foothold for persistence or broader host takeover.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8, NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-4 — Secure Configuration of Enterprise Assets and Software | Helps harden Windows storage paths and privileged file handling against link abuse. |
| Recommendation — Harden privileged Windows storage paths and remove unnecessary writable locations that attackers can redirect. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Privilege escalation is the core consequence of unsafe link following in trusted processes. |
| SI-2 — Flaw Remediation | The term is a known exploited vulnerability, so prompt remediation is central to reducing exposure. | |
| Recommendation — Restrict privileged processes so they cannot act on attacker-influenced paths beyond their required scope. Track, patch, and verify remediation for the affected Windows storage vulnerability as a priority flaw. | ||
| MITRE ATT&CK | T1068 — Exploitation for Privilege Escalation | The vulnerability can be used to raise privileges on a Windows host. |
| Recommendation — Map observed activity to privilege-escalation techniques and hunt for follow-on actions after the exploit. | ||
| NIST CSF 2.0 | PR.AA-05 — Least Privilege | Least-privilege enforcement directly reduces the impact of privileged path resolution abuse. |
| Recommendation — Constrain service and administrator permissions so link-following bugs cannot elevate routine file access. | ||
Practitioner Guidance
Why practitioners should care: Treat this as an operating-system trust boundary issue, not just a single bug in one component. The key judgment is where privileged code is allowed to resolve paths that a lower-privilege actor can influence.
What to watch for: Any workflow that combines writable directories, symbolic links or reparse points, and privileged file handling deserves extra scrutiny. Those combinations are where link-following weaknesses are most likely to become an escalation path.
Practitioner takeaway: Prioritise patching, then harden the file and service paths that privileged Windows components use so attacker-controlled links cannot steer them into protected locations.