CVE-2025-27743: System Center DPM Privilege Escalation

CVE-2025-27743 Overview

CVE-2025-27743 is a local privilege escalation vulnerability affecting multiple Microsoft System Center products. The flaw stems from an untrusted search path condition [CWE-426] that allows an authenticated attacker to elevate privileges on the local host. Microsoft published the advisory on April 8, 2025, covering System Center Data Protection Manager, Operations Manager, Orchestrator, Service Manager, and Virtual Machine Manager across the 2019, 2022, and 2025 releases.

Critical Impact
An authenticated local attacker can execute code in the context of a higher-privileged System Center service, resulting in full compromise of confidentiality, integrity, and availability on the affected host.

Affected Products

Microsoft System Center Data Protection Manager 2019, 2022, 2025
Microsoft System Center Operations Manager, Orchestrator, Service Manager 2019, 2022, 2025
Microsoft System Center Virtual Machine Manager 2019, 2022, 2025

Discovery Timeline

2025-04-08 - CVE-2025-27743 published to the National Vulnerability Database
2025-04-08 - Microsoft releases security update guidance for CVE-2025-27743
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27743

Vulnerability Analysis

The vulnerability is classified under [CWE-426] Untrusted Search Path. System Center components load binaries or dependencies from locations that a low-privileged user can influence. When a privileged System Center process starts or loads a library, it resolves the target from a search path that includes an attacker-writable directory before the trusted system location.

An authorized local user can plant a malicious dynamic-link library (DLL) or executable in a directory that appears earlier in the search order. When the vulnerable service runs, it loads the attacker-controlled binary and executes it with the privileges of the service account, which is commonly SYSTEM or a service identity with broad rights across the System Center infrastructure.

The attack requires local access and low privileges but no user interaction. Successful exploitation compromises confidentiality, integrity, and availability of the host.

Root Cause

The root cause is improper qualification of library and executable paths in one or more System Center components. Standard hardening practices such as fully qualified path resolution, SetDefaultDllDirectories, and secure loader flags are either not applied or are bypassed for the affected binaries. Windows falls back to searching user-writable directories, enabling planting attacks.

Attack Vector

Exploitation is local. An attacker with valid credentials on the System Center host places a crafted DLL or binary in a directory included in the resolved search path. The attacker then triggers the vulnerable service, scheduled task, or administrator-invoked utility. When the target process resolves and loads the planted file, code executes in the privileged context. Real-world abuse patterns include DLL side-loading, PATH hijacking, and current-working-directory attacks tied to management consoles or agent processes.

No verified public exploit or proof-of-concept has been published. Refer to the Microsoft Security Update CVE-2025-27743 advisory for authoritative technical details.

Detection Methods for CVE-2025-27743

Indicators of Compromise

Unexpected DLL or executable files written to System Center installation directories, PATH-listed folders, or the current working directory of System Center services by non-administrative accounts.
Loading of unsigned or non-Microsoft-signed modules by processes such as DPMRA.exe, HealthService.exe, Orchestrator.exe, or vmmservice.exe.
Child processes spawned by System Center service binaries that do not match expected operational behavior.

Detection Strategies

Monitor Windows Sysmon Event ID 7 (Image Loaded) for System Center processes loading modules from writable, non-standard paths.
Alert on Sysmon Event ID 11 (FileCreate) when low-privileged users write .dll or .exe files into directories referenced by System Center service search paths.
Correlate service restarts of System Center components with recent file writes in adjacent directories to catch planting followed by trigger.

Monitoring Recommendations

Baseline the modules normally loaded by each System Center service and alert on deviations, particularly unsigned binaries.
Track process creation events (Event ID 4688) where System Center service binaries spawn cmd.exe, powershell.exe, or other interpreters.
Audit filesystem access control lists (ACLs) on System Center directories and any writable folders on %PATH% to identify hijack opportunities before exploitation.

How to Mitigate CVE-2025-27743

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2025-27743 advisory to all affected System Center 2019, 2022, and 2025 installations.
Inventory hosts running Data Protection Manager, Operations Manager, Orchestrator, Service Manager, and Virtual Machine Manager and prioritize patching servers with the broadest administrative reach.
Restrict interactive and remote logon rights on System Center servers to a minimal set of administrators, since exploitation requires local authenticated access.

Patch Information

Microsoft has released fixes through the Microsoft Update channel. Consult the Microsoft Security Update CVE-2025-27743 advisory for the specific update packages and knowledge base articles corresponding to each System Center product and version.

Workarounds

Tighten ACLs on all directories referenced by System Center service search paths so that only administrators and SYSTEM can write to them.
Remove user-writable directories from the system %PATH% variable and from any per-service path configuration.
Enforce application control policies such as Windows Defender Application Control or AppLocker to block execution of unsigned binaries from non-standard locations on System Center hosts.

bash

# Configuration example: audit ACLs on a System Center install directory
icacls "C:\Program Files\Microsoft System Center" /T /C

# Remove inherited write permissions for non-privileged groups
icacls "C:\Program Files\Microsoft System Center" /inheritance:d
icacls "C:\Program Files\Microsoft System Center" /remove:g "Users" "Authenticated Users"