CVE-2025-27743 Microsoft System Center Elevation of Privilege Vulnerability
An authorized local attacker can elevate privileges via an untrusted search path in Microsoft System Center components.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-27743?
CVE-2025-27743 is a high-severity vulnerability in Microsoft System Center Data Protection Manager 2019, published on 8 Apr 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Untrusted search path in System Center allows an authorized attacker to elevate privileges locally.
Weakness: CWE-426
Which versions are affected by CVE-2025-27743?
It affects 5 products.
Products include Microsoft System Center Data Protection Manager, Microsoft System Center Operations Manager, Microsoft System Center Orchestrator, Microsoft System Center Service Manager, Microsoft System Center Virtual Machine Manager.
How do I fix CVE-2025-27743?
No fix has been published for CVE-2025-27743 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-27743 being exploited?
There is no known exploitation of CVE-2025-27743 in the wild and no public exploit code.
Sources
Also known as GHSA-6vg9-pg49-5fg4.