Severity
High
Analysis Summary
CVE-2025-21416 CVSS:8.5
Microsoft Azure Virtual Desktop could allow a remote authenticated attacker to gain elevated privileges on the system, caused by missing authorization.
CVE-2025-30389 CVSS:8.7
Microsoft Azure Bot Framework SDK could allow a remote attacker to gain elevated privileges on the system, caused by improper authorization.
CVE-2025-30391 CVSS:8.1
Microsoft Dynamics could allow a remote attacker to obtain sensitive information, caused by an improper input validation error that allows an attacker to disclose information over a network.
Impact
- Information Disclosure
- Privilege Escalation
Indicators of Compromise
CVE
CVE-2025-21416
CVE-2025-30389
CVE-2025-30391
Affected Vendors
- Microsoft
Affected Products
- Microsoft Azure Virtual Desktop
- Microsoft Azure Bot Framework SDK
- Microsoft Dynamics 365 Customer Service
Remediation
Use Microsoft Automatic Update to apply the appropriate patch for your system, or the Microsoft Security Update Guide to search for available patches.