Summary
Impact: Information Disclosure. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
What type of information could be disclosed by this vulnerability?
An attacker that successfully exploited this vulnerability could recover any data that is put in the system logs on the Compute Instance including cleartext passwords.
What further actions should I take to protect my environment after applying the fix?
Even after applying the security update, residual sensitive information may still exist in system logs. We strongly recommend that administrator users change their passwords to mitigate any potential risk from previously exposed credentials.
Security updates
10.0.26100.6899 — https://support.microsoft.com/help/5066835
10.0.25398.1913 — https://support.microsoft.com/help/5066780
Vulnerabilities 1
-
Medium 5.5
Microsoft Failover Cluster Information Disclosure Vulnerability
Insertion of sensitive information into log file in Windows Failover Cluster allows an authorized attacker to disclose information locally.
Revision history
-
#1
Information published.
References
-
CVE-2025-47979 Microsoft Failover Cluster Information Disclosure Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47979
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss