CVE-2025-21197

Improper access control in Windows NTFS allows an authorized attacker to disclose file path information under a folder where the attacker doesn't have permission to list content.

Scoring

Severity

MEDIUM

CVSS base score

6.5

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C

EPSS probability

3.20%

CWE

CWE-284

Published

2025-04-08

Last modified

2026-08-10

Affected products

• Microsoft Windows 10 Version 1507
• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• Microsoft Windows 10 Version 21H2
• Microsoft Windows 10 Version 22H2
• Microsoft Windows 11 version 22H2
• Microsoft Windows 11 version 22H3
• Microsoft Windows 11 Version 23H2

Weakness type

• CWE-284

Related vulnerabilities

• CVE-2026-65182 — Apache Tomcat: Bypass longest prefix security constraint
• CVE-2026-76607 — Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik < 4.7.2
• CVE-2026-54745 — Kubeflow Pipelines: Unauthenticated SSRF and HTTP smuggling in Kubeflow Pipelines frontend /_proxy/ route, bypasses ENABLE_AUTHZ=true
• CVE-2026-20315 — Cisco Secure Workload Software Security Hardening Release August 2026 - Improper Access Control Vulnerabilities
• CVE-2026-20192 — Cisco Identity Services Engine Hardening Release - Access Control Vulnerabilities
• CVE-2026-77553 — A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability f
• CVE-2026-77536 — A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability f
• CVE-2026-77534 — A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability f

Markdown version · Browse all CVEs