Analysis Summary

CVE-2025-21416 CVSS:8.5

Microsoft Azure Virtual Desktop could allow a remote authenticated attacker to gain elevated privileges on the system, caused by missing authorization.

CVE-2025-30389 CVSS:8.7

Microsoft Azure Bot Framework SDK could allow a remote attacker to gain elevated privileges on the system, caused by improper authorization.

CVE-2025-30391 CVSS:8.1

Microsoft Dynamics could allow a remote attacker to obtain sensitive information, caused by an improper input validation error that allows an attacker to disclose information over a network.

Impact

• Information Disclosure
• Privilege Escalation

Indicators of Compromise

CVE

• CVE-2025-21416

• CVE-2025-30389

• CVE-2025-30391

Affected Vendors

Remediation

Use Microsoft Automatic Update to apply the appropriate patch for your system, or the Microsoft Security Update Guide to search for available patches.

CVE-2025-21416

CVE-2025-30389

CVE-2025-30391