CVE-2025-21360: Privilege Escalation in Microsoft AutoUpdate

The core impact of CVE-2025-21360 lies in its potential for privilege escalation. An attacker who can successfully exploit this flaw could bypass standard security controls and execute code with elevated permissions. This could enable them to install malware, steal sensitive data, modify system configurations, or even gain complete control over the affected macOS system. The blast radius extends to any data or resources accessible by the user account under which MAU is running, and potentially beyond if the attacker can leverage the elevated privileges to compromise other parts of the system. While specific attack scenarios are not detailed in the available information, the nature of privilege escalation vulnerabilities often involves exploiting flaws in how MAU handles updates or interacts with the operating system.

1. Reserved2024-12-11
2. Published2025-01-14
3. Modified2026-02-13
4. EPSS updated2026-04-02

The primary mitigation for CVE-2025-21360 is to upgrade Microsoft AutoUpdate to version 4.76 or later. If an immediate upgrade is not feasible due to compatibility issues or system downtime constraints, consider temporarily restricting the execution of AutoUpdate processes and carefully monitoring system logs for suspicious activity. While no specific WAF or proxy rules are applicable, ensuring that the system is generally hardened against unauthorized software installations can reduce the attack surface. After upgrading, confirm the successful update by verifying the AutoUpdate version number within the Microsoft AutoUpdate application.