CVE-2025-29973: Microsoft Azure File Sync Elevation of Privilege Vulnerability
CVE-2025-29973 is an elevation of privilege vulnerability in Microsoft Azure File Sync, rated Important by Microsoft, with a CVSS 3.1 base score of 7 (High). An attacker can exploit it by an attacker with local access, with low privileges and without user interaction. Microsoft has not reported exploitation in the wild and rates exploitation as unlikely. The EPSS model estimates a 0.31% probability of exploitation activity in the next 30 days, higher than 24% of all scored vulnerabilities. Microsoft released the fix on 13 May 2025 in the May 2025 Patch Tuesday. It affects 2 products in 1 product family (Azure).
Key facts
- CVE ID
- CVE-2025-29973
- Severity
- High CVSS 7
- Microsoft severity
- Important
- Impact
- Elevation of Privilege
- Exploited in the wild
- No
- Publicly disclosed
- No
- Exploitation likelihood
- Unlikely
- Weakness
- CWE-284
- EPSS
- 0.31% (percentile 24%)
- CISA KEV
- Not listed
- Released
- Last updated
- Patch Tuesday
- May 2025 Patch Tuesday
- Product families
- Azure
CVSS score and vector
Microsoft scores CVE-2025-29973 at 7 (temporal 6.1) using CVSS 3.1. Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
| Metric | Value |
|---|---|
| Attack vector | Local |
| Attack complexity | High |
| Privileges required | Low |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality impact | High |
| Integrity impact | High |
| Availability impact | High |
| Exploit code maturity | Unproven |
| Remediation level | Official fix |
| Report confidence | Confirmed |
Description
Improper access control in Azure File Sync allows an authorized attacker to elevate privileges locally.
Frequently asked questions (Microsoft)
What actions do customers need to take to protect themselves from this vulnerability?
The vulnerability has been mitigated by a recent update to Azure File Sync's backend infrastructure and no Azure File Sync agent upgrade needed to the latest version.. Customers who are required to inspect and correct their Access Control List's have been notified through Azure Service Health Alerts under TrackingID: 4K2C-9_Z . See View service health notifications by using the Azure portal for information on how to view Azure Service Health Alerts in the Azure Portal.
Customers who have not received this Azure Service Health Alert do not need to take any action to be protected against this vulnerability.
According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
To successfully exploit this vulnerability, an attacker would need to gain elevated privileges enabling them to perform file operations in directories they would not normally be able to access or perform.
What privileges could be gained by an attacker who successfully exploited this vulnerability?
An attacker can gain permissions to access directories in Azure File Sync servers and perform file operations they do not normally have permissions to access or perform.
Affected products (2)
Azure
| Product | Security update | Type | Fixed build | Restart |
|---|---|---|---|---|
| Azure File Sync v19 | Release Notes | N/A | 26100 | Maybe |
| Azure File Sync v20 | Release Notes | N/A | 5041884 | Maybe |
NIST NVD data
- NVD status
- Analyzed
- NVD CVSS
- 7 (HIGH)
- NVD weakness
- CWE-284
- Published to NVD
- NVD last modified
Affected configurations (CPE)
| Product | Vulnerable versions |
|---|---|
| azure file sync 19.0.0.0 | all listed versions |
| azure file sync 20.0.0.0 | all listed versions |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29973 (Vendor Advisory)
Acknowledgments
- Anonymous
Revision history
| Version | Date | Description |
|---|---|---|
| 1.0 | Information published. |