CVE-2025-21360 Overview
CVE-2025-21360 is an elevation of privilege vulnerability in Microsoft AutoUpdate (MAU) for macOS. The flaw allows an authenticated local attacker to gain elevated privileges on affected systems by abusing improper privilege management in the update service. Microsoft AutoUpdate runs with elevated rights to install and update Microsoft applications on macOS, making it an attractive target for local privilege escalation. The vulnerability is tracked under [CWE-269: Improper Privilege Management] and requires low privileges and local access to exploit. No user interaction is required, and successful exploitation results in full compromise of confidentiality, integrity, and availability on the target host.
Critical Impact
A local attacker with low privileges can escalate to elevated rights on macOS endpoints running vulnerable Microsoft AutoUpdate versions, enabling full system compromise.
Affected Products
- Microsoft AutoUpdate (MAU) for macOS
- Microsoft Office for Mac deployments that rely on MAU for patching
- macOS endpoints with Microsoft applications managed by AutoUpdate
Discovery Timeline
- 2025-01-14 - CVE-2025-21360 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-21360
Vulnerability Analysis
Microsoft AutoUpdate is a helper service that maintains Microsoft software on macOS. It executes update operations with elevated privileges to write to protected application bundles and system locations. CVE-2025-21360 stems from improper privilege management within this update workflow. An authenticated local user can influence how the elevated AutoUpdate process handles files, paths, or interprocess communication to run attacker-controlled logic in a privileged context.
The vulnerability is local in nature and does not traverse the network. Exploitation does not require user interaction beyond the attacker's own session on the host. Because AutoUpdate is present on most Mac endpoints running Microsoft Office, the attack surface across enterprise fleets is broad.
Root Cause
The root cause maps to [CWE-269: Improper Privilege Management]. The privileged AutoUpdate component does not sufficiently constrain what an unprivileged caller can influence during update handling. This weakness allows a low-privileged local process to leverage the elevated service to perform actions that should be restricted to administrators or root.
Attack Vector
Exploitation requires an attacker to already have a foothold on the macOS host as a standard user. From that position, the attacker interacts with the Microsoft AutoUpdate service and abuses the privileged operation to execute code, modify protected files, or otherwise gain higher privileges. Refer to the Microsoft CVE-2025-21360 Advisory for vendor-specific technical detail.
// No verified public proof-of-concept code is available for CVE-2025-21360.
// Refer to the Microsoft Security Response Center advisory for authoritative technical detail.
Detection Methods for CVE-2025-21360
Indicators of Compromise
- Unexpected child processes spawned by Microsoft AutoUpdate.app or the Microsoft Update Assistant helper running as root.
- Modifications to files under /Library/Application Support/Microsoft/ or /Applications/Microsoft*.app that are not tied to a legitimate MAU update event.
- New or altered LaunchDaemons and LaunchAgents referencing Microsoft update binaries outside standard install windows.
Detection Strategies
- Monitor for privileged process execution originating from user-writable paths on macOS endpoints.
- Alert on interprocess communication between standard user processes and the elevated MAU helper outside normal update cycles.
- Correlate local logon events with subsequent privileged file writes to Microsoft application bundles.
Monitoring Recommendations
- Collect macOS Endpoint Security Framework telemetry for process creation, file modification, and privilege transitions on managed Macs.
- Track installed Microsoft AutoUpdate versions across the fleet and flag hosts running versions below the Microsoft patched build.
- Review audit logs for sudo, authorization, and MAU helper invocations that deviate from historical baselines.
How to Mitigate CVE-2025-21360
Immediate Actions Required
- Apply the Microsoft AutoUpdate security update referenced in the Microsoft CVE-2025-21360 Advisory to all macOS endpoints.
- Inventory macOS devices with Microsoft Office or other MAU-managed applications and confirm they are on a patched MAU build.
- Restrict local logon on sensitive Mac endpoints to reduce the pool of users who can trigger local privilege escalation.
Patch Information
Microsoft released a fix for CVE-2025-21360 through the standard Microsoft AutoUpdate channel. Administrators should ensure MAU is allowed to run and reach Microsoft update servers, then verify the installed version against the fixed build listed in the Microsoft CVE-2025-21360 Advisory. Managed deployments using MDM should push the updated MAU package to enforce compliance.
Workarounds
- Limit standard user accounts on shared Macs and enforce least privilege via MDM policy until patching is complete.
- Block or restrict execution of unsigned or unexpected helper binaries under Microsoft application directories using application control tooling.
- Increase logging of MAU helper activity and review it during the patch rollout window to detect exploitation attempts.
# Verify the installed Microsoft AutoUpdate version on a macOS endpoint
defaults read "/Library/Application Support/Microsoft/MAU2.0/Microsoft AutoUpdate.app/Contents/Info.plist" CFBundleShortVersionString
# Trigger an on-demand update check to pull the patched build
"/Library/Application Support/Microsoft/MAU2.0/Microsoft AutoUpdate.app/Contents/MacOS/Microsoft AutoUpdate" --install
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
