PatchaPalooza

CVE-2025-50171: Remote Desktop Spoofing Vulnerability

CVE-2025-50171 is a spoofing vulnerability in Remote Desktop, rated Important by Microsoft, with a CVSS 3.1 base score of 9.1 (Critical). An attacker can exploit it remotely over the network, without any privileges and without user interaction. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. The EPSS model estimates a 1.10% probability of exploitation activity in the next 30 days, higher than 66% of all scored vulnerabilities. Microsoft released the fix on 12 August 2025 in the August 2025 Patch Tuesday, delivered through 7 security updates (KB5063880, KB5063812, KB5063709, KB5063875 and more). It affects 16 products in 2 product families (Windows, ESU).

Key facts

CVE ID
CVE-2025-50171
Severity
Critical CVSS 9.1
Microsoft severity
Important
Impact
Spoofing
Exploited in the wild
No
Publicly disclosed
No
Exploitation likelihood
Less Likely
Weakness
CWE-862
EPSS
1.10% (percentile 66%)
CISA KEV
Not listed
Released
Last updated
Patch Tuesday
August 2025 Patch Tuesday
Product families
Windows, ESU

CVSS score and vector

Microsoft scores CVE-2025-50171 at 9.1 (temporal 7.9) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C

MetricValue
Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeUnchanged
Confidentiality impactHigh
Integrity impactHigh
Availability impactNone
Exploit code maturityUnproven
Remediation levelOfficial fix
Report confidenceConfirmed

Description

Missing authorization in Remote Desktop Server allows an unauthorized attacker to perform spoofing over a network.

Affected products (16)

Windows

ProductSecurity updateTypeFixed buildRestart
Windows Server 2022KB5063880
KB5063812		Security Update
SecurityHotpatchUpdate		10.0.20348.4052
10.0.20348.3989		Yes
Yes
Windows Server 2022 (Server Core installation)KB5063880
KB5063812		Security Update
SecurityHotpatchUpdate		10.0.20348.4052
10.0.20348.3989		Yes
Yes
Windows 10 Version 21H2 for 32-bit SystemsKB5063709Security Update10.0.19044.6216Yes
Windows 10 Version 21H2 for ARM64-based SystemsKB5063709Security Update10.0.19044.6216Yes
Windows 10 Version 21H2 for x64-based SystemsKB5063709Security Update10.0.19044.6216Yes
Windows Server 2025 (Server Core installation)KB5063878
KB5064010		Security Update
SecurityHotpatchUpdate		10.0.26100.4946
10.0.26100.4851		Yes
Yes
Windows 11 Version 23H2 for ARM64-based Systems
Windows 11 Version 23H2 for x64-based Systems
Windows Server 2022, 23H2 Edition (Server Core installation)KB5063899Security Update10.0.25398.1791Yes
Windows 11 Version 24H2 for ARM64-based SystemsKB5063878
KB5064010		Security Update
SecurityHotpatchUpdate		10.0.26100.4946
10.0.26100.4851		Yes
Yes
Windows 11 Version 24H2 for x64-based SystemsKB5063878
KB5064010		Security Update
SecurityHotpatchUpdate		10.0.26100.4946
10.0.26100.4851		Yes
Yes
Windows Server 2025KB5063878
KB5064010		Security Update
SecurityHotpatchUpdate		10.0.26100.4946
10.0.26100.4851		Yes
Yes

ESU

ProductSecurity updateTypeFixed buildRestart
Windows 11 Version 22H2 for x64-based SystemsKB5063875Security Update10.0.22621.5768Yes
Windows 10 Version 22H2 for x64-based Systems
Windows 10 Version 22H2 for ARM64-based Systems
Windows 10 Version 22H2 for 32-bit Systems

Security updates (7)

NIST NVD data

NVD status
Analyzed
NVD CVSS
9.1 (CRITICAL)
NVD weakness
CWE-862
Published to NVD
NVD last modified

Affected configurations (CPE)

ProductVulnerable versions
windows server 2022before 10.0.20348.3989
windows server 2022 23h2before 10.0.25398.1791
windows server 2025before 10.0.26100.4851

References

Acknowledgments

  • Philemon Orphee Favrod with Microsoft
  • Ray Reskusich with Microsoft

Revision history

VersionDateDescription
1.0Information published.

Sources