Vulnérabilité d'élévation de privilèges dans Microsoft AutoUpdate (MAU)

The core impact of CVE-2025-21360 lies in its potential for privilege escalation. An attacker who can successfully exploit this flaw could bypass standard security controls and execute code with elevated permissions. This could enable them to install malware, steal sensitive data, modify system configurations, or even gain complete control over the affected macOS system. The blast radius extends to any data or resources accessible by the user account under which MAU is running, and potentially beyond if the attacker can leverage the elevated privileges to compromise other parts of the system. While specific attack scenarios are not detailed in the available information, the nature of privilege escalation vulnerabilities often involves exploiting flaws in how MAU handles updates or interacts with the operating system.

Organizations and individuals using Microsoft AutoUpdate on macOS, particularly those running older versions (4.0.0 - 4.76), are at risk. This includes environments where AutoUpdate is configured to automatically install updates without user intervention, as this increases the potential for exploitation if a PoC is released.

• macos: Use osascript to check the AutoUpdate version:

osascript -e 'tell application "Microsoft AutoUpdate" to get version'

• macos: Monitor system logs (Console.app) for errors or unusual activity related to Microsoft AutoUpdate. Filter for processes launching with elevated privileges. • macos: Use Activity Monitor to identify any unexpected processes running under the Microsoft AutoUpdate user account.

1. 2025-01-14Disclosure

   disclosure

1. Réservé2024-12-11
2. Publiée2025-01-14
3. Modifiée2026-02-13
4. EPSS mis à jour2026-04-02

The primary mitigation for CVE-2025-21360 is to upgrade Microsoft AutoUpdate to version 4.76 or later. If an immediate upgrade is not feasible due to compatibility issues or system downtime constraints, consider temporarily restricting the execution of AutoUpdate processes and carefully monitoring system logs for suspicious activity. While no specific WAF or proxy rules are applicable, ensuring that the system is generally hardened against unauthorized software installations can reduce the attack surface. After upgrading, confirm the successful update by verifying the AutoUpdate version number within the Microsoft AutoUpdate application.