CISA’s required action for CVE-2025-24990 is to apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. In practice, find every instance of Microsoft Windows in your estate, apply the vendor security update or documented mitigation, and if no fix can be applied, remove internet exposure or take the product out of service.
What you need to do first for CVE-2025-24990
Start by confirming where Microsoft Windows is present across servers, endpoints, VDI, cloud-hosted images, and any internet-facing systems. For this class of issue, the practical question is not whether the CVE is known, but whether the vulnerable product is deployed, reachable, and able to be updated or mitigated without breaking business-critical services.
The safest path is to apply the vendor security update or the documented mitigation that Microsoft provides for the exact build in use. If the vendor path cannot be applied immediately, reduce exposure by removing internet access, tightening segmentation, or taking the affected system out of service until a supported fix or workaround is in place.
For actively exploited issues, use the CISA Known Exploited Vulnerabilities Catalog as the operational trigger for urgency, and check the NIST National Vulnerability Database and the CVE Program for the canonical record before you move into remediation.
How to reduce exposure when patching cannot happen immediately
If the update cannot be installed right away, treat compensating controls as a temporary containment measure, not a substitute for repair. The main objective is to shrink the reachable attack surface: restrict network exposure, remove unnecessary remote access paths, and make sure the affected host is not exposing the vulnerable service beyond the minimum required audience.
For teams that need a disciplined response playbook, NHIMG’s Zero-Day and Exploited Vulnerabilities Guide and Vulnerability Management Guide both support the same operational sequence: triage rapidly, apply the vendor fix or mitigation, and verify that exposure has actually dropped after the change.
When mitigation is the only option, make the exception explicit, time-bound, and owned. A control that depends on remembering to “keep it isolated” is fragile unless someone is accountable for validating that the isolation still exists after maintenance windows, image rebuilds, and configuration drift.
What to check after remediation
After patching or containment, verify more than installation status. Confirm that the vulnerable asset is no longer internet-facing if that was part of the emergency response, that the vendor mitigation remains in force, and that the system is still operating under the intended access boundaries. For Windows estates, the important check is whether every instance was found and handled, not whether one host reports success.
If the system was exposed before the fix, review for signs of earlier compromise. That means checking security logs, suspicious process creation, new scheduled tasks or services, unusual outbound connections, and any unexpected administrative activity around the time the exposure existed. If the affected system could have handled credentials, sessions, or tokens during the exposure window, rotate the relevant secrets and invalidate stale sessions where that is operationally feasible.
For post-patch validation and triage discipline, NHIMG’s Zero-Day and Exploited Vulnerabilities Guide is the best internal reference for the compromise-assessment mindset that should follow emergency remediation, while the CISA Known Exploited Vulnerabilities Catalog remains the authoritative urgency signal.
Risk and Threat Considerations
Windows vulnerabilities with an untrusted pointer dereference pattern can become high-priority because exploitation often turns a routine software defect into code execution or privilege escalation on systems that are widely deployed and difficult to segment cleanly. The real risk is not only the flaw itself, but the speed at which a public exploit or active exploitation can turn one exposed host into a foothold.
Failure mechanism: An attacker targets a reachable Windows instance before the update or mitigation is applied, then uses the weakness to execute code, gain control, or stage follow-on activity before defenders notice the exposure window has opened.
Impact: The affected system may be used for persistence, lateral movement, data theft, or further compromise of adjacent Windows assets, especially if the host is reachable from the internet or holds administrative reach into the environment.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | This CVE response is fundamentally about finding, prioritising, and remediating vulnerable Windows assets. |
| Recommendation — Prioritise exposed Windows systems and verify remediation until the vulnerable state is eliminated. | ||
| NIST CSF 2.0 | ID.RA-01 — Asset vulnerabilities are identified and recorded | You must locate every Windows instance before you can patch or mitigate the CVE. |
| PR.IP-12 — Vulnerability management plan is maintained and executed | The response requires applying vendor updates or compensating mitigations under a repeatable process. | |
| Recommendation — Identify all vulnerable Windows assets before attempting remediation. Execute your vulnerability management process to deploy the vendor fix or approved mitigation. | ||
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | The exact issue requires applying vendor-provided updates or mitigations and validating completion. |
| RA-5 — Vulnerability Monitoring and Scanning | Finding all exposed Windows instances and confirming closure requires vulnerability discovery and verification. | |
| Recommendation — Apply the vendor remediation and confirm the affected system is no longer vulnerable. Scan and validate affected Windows assets until remediation is confirmed. | ||
Practitioner Guidance
What to prioritise: Patch every reachable Microsoft Windows instance first, then work backward to systems that are harder to inventory, such as golden images, cloud templates, offline servers, and exception-managed estates. If you cannot patch all of them at once, prioritise anything internet-facing or able to authenticate into other systems.
What to verify: Confirm the vendor update or mitigation was applied to the exact affected hosts, and verify that the control did not silently fail because of reboot deferral, stale images, or configuration drift. If a system remains unpatchable, document the compensating control and the expiry date for the exception.
Practitioner takeaway: For an actively exploited Windows vulnerability, exposure management matters as much as patch installation, because the safest remediation is the one that closes the reachable attack path before an attacker can use it.
Related resources from NHI Mgmt Group
- How do you patch or mitigate CVE-2025-59287 (Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data)?
- Is CVE-2025-24990 (Microsoft Windows Untrusted Pointer Dereference) being exploited in the wild?
- How do you patch or mitigate CVE-2023-29360 (Microsoft Streaming Service Untrusted Pointer Dereference)?
- CVE-2025-24990 (Microsoft Windows Untrusted Pointer Dereference)