Summary
Impact: Elevation of Privilege. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
Successful exploitation of this vulnerability requires an administrator to install the bootstrapping agent on the target device where an attacker has planted specially crafted malicious files.
According to the CVSS metric, privileges required is low (PR:L). What does that mean for this vulnerability?
Successful exploitation of this vulnerability requires an attacker to have access to the location where the target file will be run. They would then need to plant a specific file that would be used as part of the exploitation.
What privileges could be gained by an attacker who successfully exploited this vulnerability?
An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.
According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
Successful exploitation of this vulnerability requires an attacker to take additional actions prior to exploitation to prepare the target environment.
What are the fixed build numbers for the versions of Azure Site Recovery addressed in Update Rollup 76 for Azure Site Recovery?
ASR V2A Agent (Classic VMware/Physical to Azure): ASR V2A Agent (Classic VMware/Physical to Azure), 9.63.7233.1: 9.63.7233.1, ASR H2A Agent (Hyper-V or VMM to Azure): ASR H2A Agent (Hyper-V or VMM to Azure), 5.1.8116.0: 5.1.8116.0, ASR Mars: ASR Mars, 2.0.9940.0: 2.0.9940.0
**Are there any any prerequisites for installing the update?
To install Microsoft Azure Site Recovery Provider Update Rollup 76, you must have one of the following installed:
Microsoft Azure Site Recovery Provider (version 5.23.x or a later version), Microsoft Azure Recovery Services Agent (version 2.0.9263.0 or a later version)
Security updates
9.30 — https://support.microsoft.com/en-us/topic/update-rollup-76-for-azure-site-recovery-6ca6833a-5b0f-4bdf-9946-41cd0aa8d6e4
2.0.9940.0 — https://support.microsoft.com/en-us/topic/update-for-azure-backup-for-microsoft-azure-recovery-services-agent-706ac5f8-b61d-4e5f-abc1-91e15af784cf
Vulnerabilities 1
-
Medium 6.7
Azure Agent Installer for Backup and Site Recovery Elevation of Privilege Vulnerability
Improper privilege management in Azure Agent Installer allows an authorized attacker to elevate privileges locally.
Revision history
-
#2
Updated acknowledgment. This is an informational change only.
-
#1
Information published.
References
-
CVE-2025-21199 Azure Agent Installer for Backup and Site Recovery Elevation of Privilege Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21199
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss