{"vulnerability": "cve-2025-6466", "sightings": [{"uuid": "b0c5521f-f83c-499c-92e9-0b85a8285f52", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-6466", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3ls6mharjze2m", "content": "", "creation_timestamp": "2025-06-22T08:08:41.790024Z"}, {"uuid": "d4e71b4f-9a53-4ee2-94cb-22b7028e280f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-64660", "type": "seen", "source": "https://bsky.app/profile/secqube.com/post/3m6it6keobo23", "content": "", "creation_timestamp": "2025-11-26T02:38:02.997507Z"}, {"uuid": "3798fe2f-03ab-442c-abf7-e3f6ea9b6735", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-64660", "type": "seen", "source": "https://infosec.exchange/users/cR0w/statuses/115584444564008370", "content": "", "creation_timestamp": "2025-11-20T22:44:19.591299Z"}, {"uuid": "ff4183b6-e9da-49f8-8eca-6b8a9e4b843c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-64667", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3m7lcmtsz242b", "content": "", "creation_timestamp": "2025-12-09T19:44:59.712170Z"}, {"uuid": "3e6e2c57-7bc0-410b-ba68-6a4544edf799", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-64666", "type": "seen", "source": "https://www.thezdi.com/blog/2025/12/9/the-december-2025-security-update-review", "content": "", "creation_timestamp": "2025-12-09T17:29:16.000000Z"}, {"uuid": "c8b9b5df-3e85-45cf-81fe-7a70693b829b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-64667", "type": "seen", "source": "https://www.thezdi.com/blog/2025/12/9/the-december-2025-security-update-review", "content": "", "creation_timestamp": "2025-12-09T17:29:16.000000Z"}, {"uuid": "50b37261-1e3a-4516-8850-60a1b231c9ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-64661", "type": "seen", "source": "https://www.thezdi.com/blog/2025/12/9/the-december-2025-security-update-review", "content": "", "creation_timestamp": "2025-12-09T17:29:16.000000Z"}, {"uuid": "54ddd967-a4f1-4409-b8b8-e02fb85ef12c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-64661", "type": "seen", "source": "https://advisories.ncsc.nl/advisory?id=NCSC-2025-0383", "content": "", "creation_timestamp": "2025-12-09T17:39:18.000000Z"}, {"uuid": "f140c264-ed2e-4123-81c2-c6bf308cafd5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-64666", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3m7n6gctt7u2g", "content": "", "creation_timestamp": "2025-12-10T13:35:05.874913Z"}, {"uuid": "3e704a10-448f-44e7-980a-b618a7bdc287", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-64667", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3m7n6gctt7u2g", "content": "", "creation_timestamp": "2025-12-10T13:35:05.949155Z"}, {"uuid": "952e13ad-3fff-4abe-9e52-dd373f3621b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-64669", "type": "seen", "source": "https://bsky.app/profile/r-redteamsec.bsky.social/post/3mfaiwci5md2p", "content": "", "creation_timestamp": "2026-02-19T21:09:32.452477Z"}, {"uuid": "ee2c31ef-121f-4d51-8dbf-3e3c98fa320b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-64669", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3m7sa7ooc2d24", "content": "", "creation_timestamp": "2025-12-12T13:50:28.919216Z"}, {"uuid": "ff3b8b47-2698-4c2e-8ae7-ff0faddb4501", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-64669", "type": "seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3ma6x4aoh5o2m", "content": "", "creation_timestamp": "2025-12-17T15:12:07.226763Z"}, {"uuid": "ce036fc3-599d-4c30-a750-a42096db33e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-64669", "type": "seen", "source": "https://poliverso.org/objects/0477a01e-f1f724e6-303857dbf8cb9817", "content": "", "creation_timestamp": "2025-12-17T22:27:38.555683Z"}, {"uuid": "135f773e-1e79-4a9b-912f-00be785e2622", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-64669", "type": "seen", "source": "https://bsky.app/profile/allaboutsecurity.bsky.social/post/3maavi42tjc2k", "content": "", "creation_timestamp": "2025-12-18T09:48:20.886813Z"}, {"uuid": "d435a7dd-042e-4f61-b7ac-a1d3780c30f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-64663", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3macdhl6lso2y", "content": "", "creation_timestamp": "2025-12-18T23:31:10.816679Z"}, {"uuid": "8b493c85-18d0-4ab8-8287-a0a943e2a971", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2025-64663", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/115744603727230384", "content": "", "creation_timestamp": "2025-12-19T05:34:54.968771Z"}, {"uuid": "13241a2f-9734-4774-b143-709e84da27ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-6466", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/19152", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-6466\n\ud83d\udd25 CVSS Score: 5.3 (cvssV4_0, Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P)\n\ud83d\udd39 Description: A vulnerability was found in ageerle ruoyi-ai 2.0.0 and classified as critical. Affected by this issue is the function speechToTextTranscriptionsV2/upload of the file ruoyi-modules/ruoyi-system/src/main/java/org/ruoyi/system/service/impl/SseServiceImpl.java. The manipulation of the argument File leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.1 is able to address this issue. The patch is identified as 4e93ac86d4891c59ecfcd27c051de9b3c5379315. It is recommended to upgrade the affected component.\n\ud83d\udccf Published: 2025-06-22T05:00:14.279Z\n\ud83d\udccf Modified: 2025-06-22T05:00:14.279Z\n\ud83d\udd17 References:\n1. https://vuldb.com/?id.313574\n2. https://vuldb.com/?ctiid.313574\n3. https://vuldb.com/?submit.598365\n4. https://github.com/ageerle/ruoyi-ai/issues/9\n5. https://github.com/ageerle/ruoyi-ai/issues/9#event-16775988438\n6. https://github.com/ageerle/ruoyi-ai/commit/4e93ac86d4891c59ecfcd27c051de9b3c5379315\n7. https://github.com/ageerle/ruoyi-ai/releases/tag/v2.0.1", "creation_timestamp": "2025-06-22T05:43:39.000000Z"}, {"uuid": "54329e38-eecf-41d6-bd05-b80b063cc9c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-64669", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/5549", "content": "CVE-2025-64669: Uncovering Local Privilege Escalation Vulnerability in Windows Admin Center #CVE202564669 #WindowsAdminCenter #PrivilegeEscalation #CymulateResearch #Vulnerability https://cymulate.com/blog/cve-2025-64669-windows-admin-center/", "creation_timestamp": "2026-08-03T00:18:23.062467Z"}, {"uuid": "92b0c1fd-fa73-45c9-a56d-9dec03bc6868", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-64669", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/5549", "content": "CVE-2025-64669: Uncovering Local Privilege Escalation Vulnerability in Windows Admin Center #CVE202564669 #WindowsAdminCenter #PrivilegeEscalation #CymulateResearch #Vulnerability https://cymulate.com/blog/cve-2025-64669-windows-admin-center/", "creation_timestamp": "2026-08-01T23:00:05.428333Z"}, {"uuid": "7b772a24-f6de-4a7e-b11b-69a01bf8afc5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-64669", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/5549", "content": "CVE-2025-64669: Uncovering Local Privilege Escalation Vulnerability in Windows Admin Center #CVE202564669 #WindowsAdminCenter #PrivilegeEscalation #CymulateResearch #Vulnerability https://cymulate.com/blog/cve-2025-64669-windows-admin-center/", "creation_timestamp": "2026-08-02T00:00:10.306429Z"}, {"uuid": "2ac2906a-cac6-453e-a187-d86baa4c3922", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-64669", "type": "seen", "source": "https://bsky.app/profile/r-redteamsec.bsky.social/post/3mlcfckza7b2z", "content": "CVE-2025-64669: Uncovering Local Privilege Escalation Vulnerability in Windows Admin Center", "creation_timestamp": "2026-05-07T23:41:18.039837Z"}, {"uuid": "20c74fda-77bf-43bc-aab8-056bc5ecc7c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-64669", "type": "seen", "source": "https://t.me/purp_sec/1340", "content": "\u2705  CVE-2025-64669 (CVSS 7.8): LPE \u0432 Windows Admin Center\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 Cymulate Research Labs \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0438 \u043f\u0440\u043e LPE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Microsoft Windows Admin Center (\u0432\u0435\u0440\u0441\u0438\u0438 \u0434\u043e WAC 2411), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 \u0441 low-privileged user \u0434\u043e SYSTEM. \n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u043e\u0437\u043d\u0438\u043a\u043b\u0430 \u0438\u0437-\u0437\u0430 \u0442\u043e\u0433\u043e, \u0447\u0442\u043e \u043f\u0430\u043f\u043a\u0430 C:\\ProgramData\\WindowsAdminCenter \u0438\u043c\u0435\u0435\u0442 \u043f\u0440\u0430\u0432\u0430 \u043d\u0430 \u0437\u0430\u043f\u0438\u0441\u044c \u0434\u043b\u044f \u0432\u0441\u0435\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u044b WAC \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u044e\u0442 \u043e\u0442\u0442\u0443\u0434\u0430 \u0444\u0430\u0439\u043b\u044b \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u044e\u0442 \u0438\u0445 \u043e\u0442 SYSTEM.\n\n\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043e \u0434\u0432\u0430 \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0445 \u0432\u0435\u043a\u0442\u043e\u0440\u0430 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438:\n\n\ud83d\udd35 Extension Uninstall Mechanism Abuse \u2014 \u043f\u043e\u0434\u043c\u0435\u043d\u0430 signed PowerShell-\u0441\u043a\u0440\u0438\u043f\u0442\u043e\u0432 \u0432 C:\\ProgramData\\WindowsAdminCenter\\Extensions\\\\uninstall\\, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u044e\u0442\u0441\u044f \u043e\u0442 SYSTEM \u043f\u0440\u0438 \u0434\u0435\u0438\u043d\u0441\u0442\u0430\u043b\u043b\u044f\u0446\u0438\u0438 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0439 \u0447\u0435\u0440\u0435\u0437 WAC UI/API\u200b.\n\ud83d\udd35 Updater DLL Hijacking \u2014 TOCTOU-\u0430\u0442\u0430\u043a\u0430 \u0441 \u043f\u043e\u0434\u043c\u0435\u043d\u043e\u0439 DLL \u0432 C:\\ProgramData\\WindowsAdminCenter\\Updater\\ \u0447\u0435\u0440\u0435\u0437 WMI Event \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 WindowsAdminCenterUpdater.exe, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043e\u0442 SYSTEM \u043f\u0440\u0438 \u0442\u0440\u0438\u0433\u0433\u0435\u0440\u0435 \u044d\u043d\u0434\u043f\u043e\u0438\u043d\u0442\u0430 /api/update.\n\n\u0417\u0430\u0449\u0438\u0442\u0430\n\n\ud83d\udd35 \u041e\u0431\u043d\u043e\u0432\u0438\u0442\u0435 Windows Admin Center \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 \u0432\u044b\u0448\u0435 WAC 2411.\n\n\u0412 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u043c\u0435\u0440 \u0438\u043b\u0438 \u043f\u0440\u0438 \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c\u0441\u044f:\n\n\ud83d\udd35 \u0418\u0437\u043c\u0435\u043d\u0438\u0442\u0435 ACL \u043d\u0430 C:\\ProgramData\\WindowsAdminCenter \u2014 \u0437\u0430\u043f\u0440\u0435\u0442\u0438\u0442\u0435 \u0437\u0430\u043f\u0438\u0441\u044c \u0434\u043b\u044f \u043e\u0431\u044b\u0447\u043d\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439\u200b.\n\ud83d\udd35 \u041e\u0433\u0440\u0430\u043d\u0438\u0447\u044c\u0442\u0435 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043f\u043e\u0434\u043f\u0430\u043f\u043a\u0430\u043c Extensions\\ \u0438 Updater\\ \u0442\u043e\u043b\u044c\u043a\u043e \u0434\u043b\u044f SYSTEM \u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u043e\u0432.\n\n\u27a1\ufe0f \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0432 \u043e\u0442\u0447\u0435\u0442\u0435.\n\n#blue_team #CVE #Windows #LPE", "creation_timestamp": "2026-08-14T16:00:04.395021Z"}, {"uuid": "55e23708-c759-43ca-a04c-0b6c37d001ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-64669", "type": "seen", "source": "https://t.me/purp_sec/1340", "content": "\u2705  CVE-2025-64669 (CVSS 7.8): LPE \u0432 Windows Admin Center\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 Cymulate Research Labs \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0438 \u043f\u0440\u043e LPE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Microsoft Windows Admin Center (\u0432\u0435\u0440\u0441\u0438\u0438 \u0434\u043e WAC 2411), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 \u0441 low-privileged user \u0434\u043e SYSTEM. \n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u043e\u0437\u043d\u0438\u043a\u043b\u0430 \u0438\u0437-\u0437\u0430 \u0442\u043e\u0433\u043e, \u0447\u0442\u043e \u043f\u0430\u043f\u043a\u0430 C:\\ProgramData\\WindowsAdminCenter \u0438\u043c\u0435\u0435\u0442 \u043f\u0440\u0430\u0432\u0430 \u043d\u0430 \u0437\u0430\u043f\u0438\u0441\u044c \u0434\u043b\u044f \u0432\u0441\u0435\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u044b WAC \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u044e\u0442 \u043e\u0442\u0442\u0443\u0434\u0430 \u0444\u0430\u0439\u043b\u044b \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u044e\u0442 \u0438\u0445 \u043e\u0442 SYSTEM.\n\n\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043e \u0434\u0432\u0430 \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0445 \u0432\u0435\u043a\u0442\u043e\u0440\u0430 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438:\n\n\ud83d\udd35 Extension Uninstall Mechanism Abuse \u2014 \u043f\u043e\u0434\u043c\u0435\u043d\u0430 signed PowerShell-\u0441\u043a\u0440\u0438\u043f\u0442\u043e\u0432 \u0432 C:\\ProgramData\\WindowsAdminCenter\\Extensions\\\\uninstall\\, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u044e\u0442\u0441\u044f \u043e\u0442 SYSTEM \u043f\u0440\u0438 \u0434\u0435\u0438\u043d\u0441\u0442\u0430\u043b\u043b\u044f\u0446\u0438\u0438 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0439 \u0447\u0435\u0440\u0435\u0437 WAC UI/API\u200b.\n\ud83d\udd35 Updater DLL Hijacking \u2014 TOCTOU-\u0430\u0442\u0430\u043a\u0430 \u0441 \u043f\u043e\u0434\u043c\u0435\u043d\u043e\u0439 DLL \u0432 C:\\ProgramData\\WindowsAdminCenter\\Updater\\ \u0447\u0435\u0440\u0435\u0437 WMI Event \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 WindowsAdminCenterUpdater.exe, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043e\u0442 SYSTEM \u043f\u0440\u0438 \u0442\u0440\u0438\u0433\u0433\u0435\u0440\u0435 \u044d\u043d\u0434\u043f\u043e\u0438\u043d\u0442\u0430 /api/update.\n\n\u0417\u0430\u0449\u0438\u0442\u0430\n\n\ud83d\udd35 \u041e\u0431\u043d\u043e\u0432\u0438\u0442\u0435 Windows Admin Center \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 \u0432\u044b\u0448\u0435 WAC 2411.\n\n\u0412 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u043c\u0435\u0440 \u0438\u043b\u0438 \u043f\u0440\u0438 \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c\u0441\u044f:\n\n\ud83d\udd35 \u0418\u0437\u043c\u0435\u043d\u0438\u0442\u0435 ACL \u043d\u0430 C:\\ProgramData\\WindowsAdminCenter \u2014 \u0437\u0430\u043f\u0440\u0435\u0442\u0438\u0442\u0435 \u0437\u0430\u043f\u0438\u0441\u044c \u0434\u043b\u044f \u043e\u0431\u044b\u0447\u043d\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439\u200b.\n\ud83d\udd35 \u041e\u0433\u0440\u0430\u043d\u0438\u0447\u044c\u0442\u0435 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043f\u043e\u0434\u043f\u0430\u043f\u043a\u0430\u043c Extensions\\ \u0438 Updater\\ \u0442\u043e\u043b\u044c\u043a\u043e \u0434\u043b\u044f SYSTEM \u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u043e\u0432.\n\n\u27a1\ufe0f \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0432 \u043e\u0442\u0447\u0435\u0442\u0435.\n\n#blue_team #CVE #Windows #LPE", "creation_timestamp": "2026-08-15T00:00:35.462523Z"}, {"uuid": "7b0451fa-7fe3-4360-aa8b-38cb5e19ad33", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-64669", "type": "seen", "source": "https://t.me/proxy_bar/2966", "content": "CVE-2025-64669  Windows Admin Center \n*\nUncovering Local Privilege Escalation\n\nall in one", "creation_timestamp": "2026-07-20T19:00:09.249711Z"}, {"uuid": "261b5842-2804-4dd8-beba-32e160ebfa83", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-64669", "type": "seen", "source": "https://t.me/proxy_bar/2966", "content": "CVE-2025-64669  Windows Admin Center \n*\nUncovering Local Privilege Escalation\n\nall in one", "creation_timestamp": "2026-07-21T00:00:27.987794Z"}, {"uuid": "98533c1e-5ca2-4795-986f-ac37b6cf87d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-64669", "type": "seen", "source": "https://t.me/proxy_bar/2966", "content": "CVE-2025-64669  Windows Admin Center \n*\nUncovering Local Privilege Escalation\n\nall in one", "creation_timestamp": "2026-07-22T00:00:26.323531Z"}, {"uuid": "2ce5d71c-1a0d-4567-87ae-e9172f47838d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-64669", "type": "seen", "source": "https://t.me/reverseame/5549", "content": "CVE-2025-64669: Uncovering Local Privilege Escalation Vulnerability in Windows Admin Center #CVE202564669 #WindowsAdminCenter #PrivilegeEscalation #CymulateResearch #Vulnerability https://cymulate.com/blog/cve-2025-64669-windows-admin-center/", "creation_timestamp": "2026-07-29T08:01:21.112269Z"}, {"uuid": "017883f6-afa6-4b17-bd9b-ad667c4c81e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-64669", "type": "seen", "source": "https://t.me/reverseame/5549", "content": "CVE-2025-64669: Uncovering Local Privilege Escalation Vulnerability in Windows Admin Center #CVE202564669 #WindowsAdminCenter #PrivilegeEscalation #CymulateResearch #Vulnerability https://cymulate.com/blog/cve-2025-64669-windows-admin-center/", "creation_timestamp": "2026-07-30T00:02:11.097924Z"}, {"uuid": "cf923c9d-6de7-493c-a87c-2b0467e716f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-64669", "type": "seen", "source": "https://t.me/hacking_Attack/176015", "content": "CVE-2025-64669: Uncovering Local Privilege Escalation Vulnerability in Windows Admin Center\nhttps://www.reddit.com/r/redteamsec/comments/1pncyhx/cve202564669_uncovering_local_privilege/\n\nMicrosoft has released a fix for CVE-2025-64669, addressing a local privilege escalation vulnerability we reported in Windows Admin Center.\n This issue allowed low privileged users to escalate to SYSTEM by abusing trusted components under insecure filesystem permissions. Microsoft validated the finding and shipped a fix as part of the latest update.\n This CVE represents only the first vulnerability from our research.\n We identified four distinct vulnerabilities during the investigation, and additional fixes and disclosures are coming.\n More details soon.\n Stay tuned.    submitted by    /u/Fun_Preference1113  (https://www.reddit.com/user/Fun_Preference1113) \n [link] (https://cymulate.com/blog/cve-2025-64669-windows-admin-center/)   [comments] (https://www.reddit.com/r/redteamsec/comments/1pncyhx/cve202564669_uncovering_local_privilege/)", "creation_timestamp": "2026-09-01T20:00:15.050272Z"}, {"uuid": "e47a064f-079b-4417-b175-697995367074", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-64669", "type": "seen", "source": "https://t.me/hacking_Attack/176015", "content": "CVE-2025-64669: Uncovering Local Privilege Escalation Vulnerability in Windows Admin Center\nhttps://www.reddit.com/r/redteamsec/comments/1pncyhx/cve202564669_uncovering_local_privilege/\n\nMicrosoft has released a fix for CVE-2025-64669, addressing a local privilege escalation vulnerability we reported in Windows Admin Center.\n This issue allowed low privileged users to escalate to SYSTEM by abusing trusted components under insecure filesystem permissions. Microsoft validated the finding and shipped a fix as part of the latest update.\n This CVE represents only the first vulnerability from our research.\n We identified four distinct vulnerabilities during the investigation, and additional fixes and disclosures are coming.\n More details soon.\n Stay tuned.    submitted by    /u/Fun_Preference1113  (https://www.reddit.com/user/Fun_Preference1113) \n [link] (https://cymulate.com/blog/cve-2025-64669-windows-admin-center/)   [comments] (https://www.reddit.com/r/redteamsec/comments/1pncyhx/cve202564669_uncovering_local_privilege/)", "creation_timestamp": "2026-09-02T01:00:33.258959Z"}, {"uuid": "7b49e765-c741-45c1-8c09-84050ee1a655", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-64669", "type": "seen", "source": "https://t.me/HackingTeamGrupoOfficial/44809", "content": "CVE-2025-64669: Uncovering Local Privilege Escalation Vulnerability in Windows Admin Center  https://cymulate.com/blog/cve-2025-64669-windows-admin-center/", "creation_timestamp": "2026-09-02T06:00:15.388151Z"}, {"uuid": "dda9bd95-d3e4-48e2-a024-e287c3d5a959", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-64669", "type": "published-proof-of-concept", "source": "https://t.me/HackingTeamGrupoOfficial/44809", "content": "CVE-2025-64669: Uncovering Local Privilege Escalation Vulnerability in Windows Admin Center  https://cymulate.com/blog/cve-2025-64669-windows-admin-center/", "creation_timestamp": "2026-09-03T00:00:47.332490Z"}, {"uuid": "5276c73c-c7a8-4fb1-b1bb-1df156733cfc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-64669", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/176015", "content": "CVE-2025-64669: Uncovering Local Privilege Escalation Vulnerability in Windows Admin Center\nhttps://www.reddit.com/r/redteamsec/comments/1pncyhx/cve202564669_uncovering_local_privilege/\n\nMicrosoft has released a fix for CVE-2025-64669, addressing a local privilege escalation vulnerability we reported in Windows Admin Center.\n This issue allowed low privileged users to escalate to SYSTEM by abusing trusted components under insecure filesystem permissions. Microsoft validated the finding and shipped a fix as part of the latest update.\n This CVE represents only the first vulnerability from our research.\n We identified four distinct vulnerabilities during the investigation, and additional fixes and disclosures are coming.\n More details soon.\n Stay tuned.    submitted by    /u/Fun_Preference1113  (https://www.reddit.com/user/Fun_Preference1113) \n [link] (https://cymulate.com/blog/cve-2025-64669-windows-admin-center/)   [comments] (https://www.reddit.com/r/redteamsec/comments/1pncyhx/cve202564669_uncovering_local_privilege/)", "creation_timestamp": "2026-09-03T02:00:04.141313Z"}, {"uuid": "cfa27856-1824-4999-9f39-a0875b1e8c41", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-64669", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/176015", "content": "CVE-2025-64669: Uncovering Local Privilege Escalation Vulnerability in Windows Admin Center\nhttps://www.reddit.com/r/redteamsec/comments/1pncyhx/cve202564669_uncovering_local_privilege/\n\nMicrosoft has released a fix for CVE-2025-64669, addressing a local privilege escalation vulnerability we reported in Windows Admin Center.\n This issue allowed low privileged users to escalate to SYSTEM by abusing trusted components under insecure filesystem permissions. Microsoft validated the finding and shipped a fix as part of the latest update.\n This CVE represents only the first vulnerability from our research.\n We identified four distinct vulnerabilities during the investigation, and additional fixes and disclosures are coming.\n More details soon.\n Stay tuned.    submitted by    /u/Fun_Preference1113  (https://www.reddit.com/user/Fun_Preference1113) \n [link] (https://cymulate.com/blog/cve-2025-64669-windows-admin-center/)   [comments] (https://www.reddit.com/r/redteamsec/comments/1pncyhx/cve202564669_uncovering_local_privilege/)", "creation_timestamp": "2026-09-04T00:01:05.156451Z"}]}