CVE-2025-58074: Norton Secure VPN Privilege Escalation

CVE-2025-58074 Overview

CVE-2025-58074 is a local privilege escalation vulnerability in the Norton Secure VPN installer distributed through the Microsoft Store. A low-privilege user can replace files during the installation process, leading to arbitrary file deletion that can be leveraged to elevate privileges. The flaw is tracked under [CWE-1386: Insecure Operation on Windows Junction / Mount Point]. The vulnerability was reported by Cisco Talos and assigned identifier TALOS-2025-2276. Successful exploitation grants attackers the ability to escalate from a standard user account to higher-privilege contexts on the affected Windows host.

Critical Impact
A local attacker with low privileges can abuse the installer's file handling to delete arbitrary files protected by SYSTEM-level permissions, enabling privilege escalation on Windows endpoints.

Affected Products

Norton Secure VPN (Microsoft Store distribution)
Windows installations using the Microsoft Store deployment of Norton Secure VPN
Endpoints where Norton Secure VPN is installed by users with standard privileges

Discovery Timeline

2026-05-04 - CVE-2025-58074 published to NVD
2026-05-04 - Last updated in NVD database

Technical Details for CVE-2025-58074

Vulnerability Analysis

The vulnerability resides in the installation workflow executed when Norton Secure VPN is acquired through the Microsoft Store. During installation, the process operates on files in a location writable or influenceable by a low-privilege user. An attacker monitoring the installation can replace, redirect, or substitute files before the installer completes its operations. Because the installer performs privileged file operations, the substituted paths cause arbitrary file deletion outside the user's normal access scope. Deletion of SYSTEM-owned files is a known primitive that attackers convert into full privilege escalation through DLL hijacking, service redirection, or Windows Installer rollback techniques.

Root Cause

The root cause is mapped to [CWE-1386], which covers insecure operations on Windows junctions or mount points. The installer fails to validate that file system objects it operates on are not symbolic links, junctions, or mount points controlled by the calling user. A low-privilege user can plant a junction that redirects the installer's file operations to protected locations. The installer then performs deletions or modifications on attacker-chosen paths under elevated context.

Attack Vector

Exploitation requires local access and low-level privileges on the target system. The attacker initiates or waits for an installation of Norton Secure VPN from the Microsoft Store. During the install window, the attacker creates a filesystem junction or replaces an expected file in a user-writable directory used by the installer. The installer follows the junction or processes the substituted file under elevated rights. The result is deletion of files chosen by the attacker, including files required for system integrity. Conversion to code execution typically follows by abusing the deletion to break protections on writable paths or to replace trusted binaries loaded by SYSTEM services. Refer to the Talos Intelligence Vulnerability Report for technical details.

Detection Methods for CVE-2025-58074

Indicators of Compromise

Creation of NTFS junctions or symbolic links by non-administrative users in directories used during Norton Secure VPN installation.
Unexpected deletion of SYSTEM-owned files coinciding with execution of the Norton Secure VPN Microsoft Store installer.
Process trees showing the Norton installer performing file operations on paths outside the standard installation directory.

Detection Strategies

Monitor AppData\Local\Packages and WindowsApps directories for junction creation events using Sysmon Event ID 11 and 12.
Alert on file deletion events targeting protected directories such as C:\Windows\System32 and C:\Program Files originating from MSIX installer processes.
Correlate Microsoft Store installation telemetry with subsequent privilege changes or new service registrations on the host.

Monitoring Recommendations

Enable Windows audit policy for object access on system directories to capture deletion attempts during package installs.
Track creation of reparse points by standard users using EDR telemetry and flag installations preceded by such activity.
Review installation logs in %TEMP% and Windows event logs for anomalies during Norton Secure VPN deployment.

How to Mitigate CVE-2025-58074

Immediate Actions Required

Update Norton Secure VPN to the latest version available through the Microsoft Store once a patched build is published by Gen Digital.
Restrict installation of Microsoft Store applications to administrators on managed endpoints until patched versions are confirmed deployed.
Audit endpoints for existing Norton Secure VPN installations and verify install integrity against vendor-provided checksums.

Patch Information

Review the Talos Intelligence Vulnerability Report for vendor coordination details and patched release information. Apply the vendor-supplied update through the Microsoft Store update channel as soon as it is available.

Workarounds

Block installation of Norton Secure VPN from the Microsoft Store via AppLocker or Windows Defender Application Control until the fixed version is released.
Limit standard users from creating reparse points by removing the SeCreateSymbolicLinkPrivilege from non-administrative groups.
Perform installations only from elevated administrator sessions on systems where standard users cannot interact with installer working directories.

bash

# Configuration example - restrict symbolic link creation for non-admins
secedit /export /cfg current.inf
# Edit current.inf and remove standard users from SeCreateSymbolicLinkPrivilege
secedit /configure /db secedit.sdb /cfg current.inf