Is CVE-2025-62221 actively exploited?

Yes. CVE-2025-62221 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means exploitation in the wild has been confirmed.

Can CVE-2025-62221 be exploited remotely?

No. CVE-2025-62221 requires local access to exploit.

What is the CVSS score of CVE-2025-62221?

CVE-2025-62221 has a CVSS score of 7.8 (HIGH) and an EPSS exploitation probability of 2.73%.

HOME VULNERABILITIESCVE-2025-62221

HIGHCISA KEVIN THE WILD

CVE-2025-62221

Published: December 9, 2025

7.8

CVSS v3.1

EPSS:2.73%probability of exploitation in 30 daysPercentile:85.7th

Official Description

Microsoft Windows Cloud Files Mini Filter Driver contains a use after free vulnerability that can allow an authorized attacker to elevate privileges locally.

NVD Source

CISA KEV Advisory

Microsoft Windows Use After Free Vulnerability

Microsoft Windows Cloud Files Mini Filter Driver contains a use after free vulnerability that can allow an authorized attacker to elevate privileges locally.

Added to KEV: 2025-12-09Federal patch deadline: 2025-12-30

Required Action (CISA)

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Risk Analysis

This vulnerability in the Microsoft Windows Cloud Files Mini Filter Driver allows an authenticated local attacker to elevate their privileges. With a CVSS score of 7.8, it is considered a high-severity flaw. The EPSS score of 0.02730 indicates a low likelihood of exploitation, but its presence in CISA's KEV catalog confirms it has been actively exploited.

Active exploitation of this vulnerability has been observed in the wild, as confirmed by its inclusion in CISA's KEV catalog. The attack requires local access and authentication.

Recommended Action

Apply the latest security updates from Microsoft to patch the Windows Cloud Files Mini Filter Driver. Ensure systems are regularly updated to mitigate known vulnerabilities.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2025-62221 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 7.8.

CISA has added CVE-2025-62221 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.