Loading vulnerability…
Windows Administrator Protection Untrusted Search Path Elevation of Privilege
CVE-2025-60718 is a local elevation-of-privilege vulnerability in Windows Administrator Protection caused by an untrusted search path condition. The flaw allows Windows to resolve and load an executable or other required resource from an attacker-controlled location instead of a trusted path. An authorized local attacker can abuse this search-order weakness to execute attacker-controlled code in a more privileged security context, resulting in privilege escalation on the affected system. Public reporting indicates proof-of-concept exploit code has been released.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows a local authorized attacker to elevate privileges on the affected Windows system. This can enable execution of code with higher privileges than initially granted, potentially allowing takeover of the local host, tampering with protected system settings or files, installation of persistent components, credential access, and use of the compromised system for further post-exploitation activity.
If you can’t patch tonight, do this now.
Until patches are fully deployed, reduce exposure by restricting local user ability to place executables or libraries in directories that may be searched by privileged processes, enforcing least privilege for local accounts, tightening write permissions on filesystem locations accessible to non-administrative users, and monitoring for anomalous privileged process launches consistent with search-order hijacking. Application control and allowlisting can further reduce the likelihood of successful exploitation.
Patch, then assume compromise.
Apply the Microsoft security update that addresses CVE-2025-60718 for all affected Windows versions. Prioritize patching systems where Windows Administrator Protection is present and where local users can introduce files into directories that may be searched during privileged execution. Validate that the update corrects the unsafe search-path behavior and review application and system configurations for any remaining reliance on unqualified path resolution.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.