CVE-2025-21343: Information Disclosure in Windows Web Threat Defense

Successful exploitation of CVE-2025-21343 could allow an attacker to gain unauthorized access to sensitive data processed by the Windows Web Threat Defense User Service. The specific data exposed depends on the service's configuration and the data it handles, but could include user credentials, network configurations, or other confidential information. While the vulnerability is classified as Information Disclosure, the potential for data compromise could lead to further attacks, such as privilege escalation or data exfiltration. The blast radius is limited to systems running the affected versions of Windows and utilizing the Web Threat Defense User Service.

1. Reserved2024-12-11
2. Published2025-01-14
3. Modified2026-02-13
4. EPSS updated2026-04-02

The primary mitigation for CVE-2025-21343 is to upgrade to Windows version 10.0.26100.2894 or later, which includes the security update that resolves the vulnerability. If immediate patching is not feasible, consider implementing network segmentation to limit the potential impact of a successful exploit. Monitor network traffic for unusual activity related to the Web Threat Defense User Service. While no specific WAF rules are available, general rules to detect unusual data access patterns could be helpful.