Is CVE-2025-21391 (Microsoft Windows Storage Link Following) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2025-21391 to its Known Exploited Vulnerabilities catalogue on 11 February 2025, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Microsoft Windows Storage contains a link following vulnerability that could allow for privilege escalation. Any organisation running the affected product should treat remediation as urgent.

What “actively exploited” means for a Windows vulnerability

For this CVE, the practical question is not whether the flaw exists, but whether it has crossed from theoretical exposure into confirmed abuse. When CISA places an issue in KEV, it is signalling that defenders should treat it as an urgent operational problem, not a routine patch item. That matters because active exploitation changes priority, response timing, and the need for follow-up validation.

In that context, the most useful next step is to treat the affected Windows Storage surface as exposure that may already be targeted, especially if the system has broad internal reach or is reachable by untrusted users. An exploitation path that enables privilege escalation can quickly turn a local weakness into broader administrative control.

Why link-following flaws are security-relevant

Link-following weaknesses are dangerous because they let an attacker influence where a privileged process reads, writes, or follows a path. In Windows environments, that can turn a low-privilege foothold into unintended access to protected locations, especially when a service, installer, updater, or maintenance task operates with elevated rights. The core issue is not the link itself, but the trust boundary it bypasses.

That is why exploitability often depends on more than one condition: attacker-controlled content, privileged file handling, and a component that fails to validate the target before acting on it. When those line up, the flaw can become a privilege escalation primitive rather than just a filesystem bug.

For background on how Microsoft Windows Storage and related weaknesses fit into broader vulnerability handling, see the Zero-Day and Exploited Vulnerabilities Guide and the Vulnerability Management Guide.

What defenders should do first when patching is urgent

The right first move is exposure confirmation, not broad speculation. Identify where the product is present, which hosts are internet-facing or high-value, and whether any privileged Windows storage operations are occurring in workflows that could be influenced by lower-trust users or files. If the system is externally reachable or supports untrusted input, treat it as a higher-priority candidate for immediate remediation.

If patching has to wait, reduce the reachable attack surface around the vulnerable host. That means restricting who can interact with the affected service, tightening file and path handling where possible, and watching for abnormal privilege use, unexpected file creation, or storage-related activity that appears inconsistent with normal administration. Because CISA has already placed the issue in KEV, delay should be treated as an exception, not a normal state.

Keep a tight remediation record: which systems were exposed, when they were fixed, and whether any unusual behaviour appeared before the update. For a vulnerability with confirmed exploitation, that record supports both incident review and operational assurance.

Risk and Threat Considerations

Confirmed exploitation shifts this issue from preventive hardening to compromise assessment. A link-following flaw can be used to redirect a privileged operation, which makes it attractive for attackers seeking elevation from a constrained foothold to higher system control.

Failure mechanism: A privileged Windows Storage action follows an attacker-influenced link or path target, allowing the system to act on an unintended object and grant escalation or unsafe access.

Impact: The attacker may gain elevated privileges, persistence opportunities, or a stronger position for lateral movement, especially if the vulnerable host also stores sensitive data or supports administrative workflows.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-4 — Secure Configuration of Enterprise Assets and Software	Active exploitation makes rapid asset exposure reduction and secure configuration central.
	CIS-7 — Continuous Vulnerability Management	The question is about a KEV-listed vulnerability requiring urgent prioritisation and validation.
Recommendation — Harden affected Windows hosts and remove unnecessary exposure paths until remediation is complete. Prioritise, patch, and verify exposed systems using KEV-driven vulnerability management.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	Confirmed exploitation makes timely remediation the primary control response.
	RA-5 — Vulnerability Monitoring and Scanning	Exposure confirmation and post-discovery validation depend on continuous vulnerability identification.
Recommendation — Remediate the flaw promptly and track completion for every affected system. Scan for the vulnerable Windows Storage condition and confirm remediation status after patching.
NIST CSF 2.0	GV.RM-01 — Risk Management Strategy	KEV inclusion requires urgent risk prioritisation and exception handling.
Recommendation — Treat KEV-listed exploitation as a high-priority risk event in remediation planning.

Practitioner Guidance

What to verify: Confirm whether the vulnerable product is installed anywhere that matters operationally, then verify whether those systems have been patched or otherwise removed from the exposure set. If you cannot confirm version and exposure status quickly, assume the system needs urgent review.

Decision rule: If the host is critical, reachable, or used for privileged storage operations, treat the case as a remediation and hunting priority rather than a deferred maintenance item. If you find signs of suspicious file or privilege activity around the exposure window, escalate to incident handling immediately.

Practitioner takeaway: For a KEV-listed Windows privilege-escalation flaw, the key judgement is speed plus verification, patch fast, then validate whether the system showed signs of misuse before the fix landed.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org