CVE-2025-60721 Overview
CVE-2025-60721 is a local privilege escalation vulnerability in the Windows Administrator Protection feature of Windows 11 24H2 and 25H2. The flaw stems from a privilege context switching error [CWE-270] that allows an authorized local attacker to elevate privileges on the affected system. Microsoft published the advisory on November 11, 2025, and the vulnerability affects the confidentiality, integrity, and availability of the host.
An attacker who already holds low-privileged access on a vulnerable Windows 11 endpoint can abuse the flawed context switching logic to gain higher privileges without user interaction. No public proof-of-concept code or in-the-wild exploitation has been reported at this time.
Critical Impact
Successful exploitation grants an authenticated local attacker elevated privileges, enabling full control over the affected Windows 11 host including code execution in a privileged context.
Affected Products
- Microsoft Windows 11 24H2
- Microsoft Windows 11 25H2
- Windows Administrator Protection component
Discovery Timeline
- 2025-11-11 - CVE-2025-60721 published to NVD
- 2025-11-11 - Microsoft releases security advisory and patch
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-60721
Vulnerability Analysis
The vulnerability resides in the Windows Administrator Protection feature, a security mechanism designed to isolate administrative operations from standard user contexts. A privilege context switching error [CWE-270] causes the system to fail to enforce proper privilege boundaries during transitions between security contexts.
When the operating system switches between user and administrative contexts, the flawed logic can retain or grant privileges that should have been dropped or denied. An authorized local user leverages this incorrect state to execute operations reserved for higher-privileged accounts. The impact spans confidentiality, integrity, and availability because the elevated context permits arbitrary changes to protected resources.
Root Cause
The root cause is improper privilege management during context switching within the Administrator Protection subsystem. The feature is intended to reduce standing administrator rights by requiring explicit elevation for privileged operations. The implementation fails to correctly validate or enforce the privilege state during specific transitions, breaking the security boundary between user-mode and administrator-mode operations.
Attack Vector
Exploitation requires local access and low-privileged authenticated credentials on the target host. The attacker executes code that triggers the affected privilege context switching path in Windows Administrator Protection. User interaction is not required. Once the flawed transition executes, the attacker obtains elevated privileges and can install programs, modify system data, or create new accounts with administrative rights.
No verified public exploit code is available. See the Microsoft CVE-2025-60721 Advisory for vendor technical details.
Detection Methods for CVE-2025-60721
Indicators of Compromise
- Unexpected process creation events where a low-privileged parent spawns a child process with SYSTEM or administrator integrity level.
- Anomalous token manipulation or impersonation events in Windows Security event logs on Windows 11 24H2 and 25H2 hosts.
- Creation of new local administrator accounts or modifications to privileged group membership following execution of unsigned or unusual binaries.
Detection Strategies
- Hunt for integrity-level transitions that do not correspond to legitimate User Account Control (UAC) prompts or Administrator Protection elevation flows.
- Correlate Event ID 4672 (special privileges assigned) with the originating process to identify unexpected privilege grants to standard users.
- Monitor for exploitation tooling patterns that probe Administrator Protection APIs or trigger rapid context switches.
Monitoring Recommendations
- Enable detailed Windows audit policies for process creation, token manipulation, and privilege use on all Windows 11 24H2 and 25H2 endpoints.
- Forward endpoint telemetry to a centralized analytics platform to baseline privileged operations and flag deviations.
- Alert on any local account elevation event on hosts that have not yet received the November 2025 security update.
How to Mitigate CVE-2025-60721
Immediate Actions Required
- Apply the November 2025 Microsoft security update for Windows 11 24H2 and 25H2 as documented in the Microsoft CVE-2025-60721 Advisory.
- Inventory all Windows 11 24H2 and 25H2 hosts and prioritize patching on systems where non-administrative users have interactive logon rights.
- Restrict local logon and remote interactive session capabilities to trusted accounts until patching is complete.
Patch Information
Microsoft addressed CVE-2025-60721 in the November 11, 2025 security update. Administrators should deploy the cumulative update for Windows 11 24H2 and 25H2 via Windows Update, Windows Server Update Services (WSUS), or Microsoft Update Catalog. Refer to the Microsoft Security Response Center advisory for build numbers and KB identifiers.
Workarounds
- No official workaround is published by Microsoft. Patching is the required remediation.
- Enforce least-privilege on all local accounts and remove unnecessary interactive logon rights to reduce the attack surface for local exploitation.
- Apply application allowlisting policies such as Windows Defender Application Control (WDAC) to block unauthorized binaries from executing on affected endpoints.
# Verify installed updates on Windows 11 24H2/25H2
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10
# Confirm OS build version
[System.Environment]::OSVersion.Version
(Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion").DisplayVersion
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
