Summary
Impact: Information Disclosure. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
What type of information could be disclosed by this vulnerability?
The type of information that could be disclosed if an attacker successfully exploited this vulnerability includes unauthorized read-only access to the local file system.
Security updates
0.45.0.0 — https://learn.microsoft.com/en-us/windows-server/manage/windows-admin-center/azure/extension-release-notes
2.4.2.1 — https://aka.ms/wac2410
Vulnerabilities 1
-
Medium 6.2
Windows Admin Center in Azure Portal Information Disclosure Vulnerability
External control of file name or path in Azure Portal Windows Admin Center allows an unauthorized attacker to disclose information locally.
Revision history
-
#3
Updated acknowledgment. This is an informational change only.
-
#2
Updated acknowledgment. This is an informational change only.
-
#1
Information published.
References
-
CVE-2025-29819 Windows Admin Center in Azure Portal Information Disclosure Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29819
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss