CVE-2025-59213
Published: 14 October 2025
Description
Adversaries may leverage databases to mine valuable information.
Security Summary
CVE-2025-59213 is an SQL injection vulnerability (CWE-89) in Microsoft Configuration Manager, stemming from improper neutralization of special elements used in an SQL command. Published on 2025-10-14, it carries a CVSS v3.1 base score of 8.8 (High), with vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating high impacts on confidentiality, integrity, and availability.
An unauthorized attacker on an adjacent network can exploit this vulnerability with low complexity and no required privileges or user interaction. Successful exploitation enables privilege escalation, potentially allowing the attacker to gain elevated access within the affected Configuration Manager environment.
The Microsoft Security Response Center (MSRC) advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59213 provides details on mitigation and available patches. Security practitioners should consult this resource for specific remediation steps, such as applying updates to vulnerable installations.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
SQL injection in Microsoft Configuration Manager enables arbitrary database queries for data collection (T1213.006), exploitation of a remote management service (T1210), and privilege escalation via the vulnerability (T1068).