CVE-2025-60718: Mitigating Untrusted Search Path in Windows Administrator Protection

Microsoft has published a security advisory for CVE-2025-60718, a high-severity elevation-of-privilege (EoP) vulnerability in the new Windows Administrator Protection elevation model that can let an authenticated local attacker gain administrator-equivalent rights through an untrusted search path issue — administrators must apply vendor updates immediately and review local account exposure while detection and mitigation work proceeds.

Background / Overview​

Administrator Protection is a significant architectural change to how Windows handles interactive administrator sessions: rather than giving administrator accounts a persistent elevated token, Windows issues a just-in-time, system-managed, isolated admin token for each privileged operation and tears that token down when the operation completes. The goal is to reduce ambient admin token lifetime, close longstanding UAC/auto-elevation attack surfaces, and require stronger authentication for elevation (for example, Windows Hello) when Administrator Protection is enabled. This model has been described in Microsoft’s product communications and by technical observers as a deliberate platform-level hardening of the elevation model. CVE-2025-60718 targets that Administrator Protection implementation. Public advisories characterize the flaw as an untrusted search path weakness (CWE‑426 / CWE‑427 class), where privileged code resolves and loads a resource using a search path that an attacker with local write or network-share placement capabilities can influence. When the privileged Administrator Protection flow follows an attacker-controlled path and loads attacker-supplied code or configuration instead of the intended resource, the attacker can cause a process associated with the temporary admin token to execute attacker-controlled code — and thereby escalate their privileges to the level of a system-managed administrator. The vendor lists affected Windows 11 releases and provides security updates to remediate the issue.

---

What the vulnerability actually is​

Technical classification and impact​

• Vulnerability type: Untrusted search path / DLL/executable search order hijack (CWE‑426 / CWE‑427).
• Affected component: Windows Administrator Protection elevation flow.
• Impact: Local Elevation of Privilege — low-privileged authenticated attacker → administrative-equivalent privileges (system-managed admin token).
• Vendor severity / scoring: public trackers list a CVSS v3.1 base score of 7.8 (High) for the CVE entry published Nov 11, 2025.

An untrusted search path vulnerability occurs when privileged code locates a dependent file (DLL, helper executable, configuration file) by searching a set of directories that include locations an attacker can alter (current working directory, user-writable temp directories, or network shares). If the privileged process later loads the first matching file without using a fully qualified, trusted path or verifying origin and integrity, an attacker can place a malicious file in the search order and have it loaded into the privileged process. This pattern has a long history in Windows EoP advisories and often leads to reliable privilege escalation chains when paired with a local foothold.

Attack model and prerequisites​

• Local authenticated access: the attacker needs an account or the ability to run code on the target host (local or via a network share mapped into the host’s namespace).
• Write/placement capability in a directory that the Administrator Protection flow will search (for example, the current working directory, a writable folder on a network share that is enumerated early in the search path, or a temp folder used by an elevated helper).
• Timing or access to trigger an Administrator Protection elevation flow that will resolve and load the attacker-controlled resource.
• No user interaction is necessary beyond the attacker’s local actions in most public descriptions — the weakness is primarily a local EoP, not an unauthenticated remote RCE.

Public reporting and the vendor advisory emphasize the local-authenticated attack vector and the relatively low technical complexity for experienced operators once local placement is possible. This makes the vulnerability a practical building block in post-compromise escalation chains.

---

Why Administrator Protection matters — and why this CVE is important​

Administrator Protection is designed to reduce the “blast radius” of long-lived admin tokens and to block many classic elevation techniques that rely on persistent admin sessions or auto-elevation. Its arrival changes assumptions for both defenders and attackers:

• For defenders: it reduces the window that malware or a malicious child process has to inherit elevated rights from an already-elevated interactive session.
• For attackers: the model forces exploit authors to find new vectors into the elevation issuance code paths — precisely where CVE-2025-60718 is located.

Because Administrator Protection itself is an elevation gate, a vulnerability in that gate is high-value: if attacker-supplied code can be made to load inside the short-lived admin token’s process, the attacker effectively defeats the protective model by inserting malicious logic into the privileged context. In short, Administrator Protection raises the bar in multiple areas — but any vulnerability inside its new, centralized code paths is by definition an attractive target. Community coverage of the feature and its risk/compatibility trade-offs has been prominent in recent release notes and analysis.

---

Confirming the facts: vendor advisory and independent corroboration​

• Microsoft’s Security Update Guide lists CVE-2025-60718 and the vendor’s remediation guidance for affected SKUs (the vendor page is the authoritative mapping of CVE → KB → build). Administrators must map the CVE to the correct KB for their Windows 11 builds and apply the update provided by Microsoft. The MSRC advisory is the canonical source for affected builds and fixes.
• Independent aggregators and threat-intel feeds mirrored the advisory and assigned a CVSS 3.1 score of 7.8, describing the root cause as an untrusted search path in Administrator Protection and confirming that the issue enables local privilege escalation when exploited. These mirrors list Windows 11 24H2, 25H2 and 2H2 channel builds among the affected SKUs and report that Microsoft has provided a patch.

Caveat: Microsoft’s dynamic Security Update Guide is the authoritative place to confirm exact KB numbers per build. Community feeds are useful early warning signals, but patch deployment decisions should be based on Microsoft’s KB mapping for each target build. Administrators should confirm KB identifiers in the vendor update guide before rolling out fixes at scale.

---

Practical risk assessment for administrators and enterprises​

Short-term risk​

• High for compromised endpoints: If an adversary already has a local foothold (for example via malicious docs, credential theft or lateral movement), CVE-2025-60718 provides a feasible path to elevate to administrative-level access on that host.
• Attack complexity: Low-to-moderate once local write-placement and elevation trigger control are possible. Untrusted search path issues have short, repeatable exploitation patterns and have produced Proof-of-Concepts quickly in past disclosures.
• In-the-wild exploitation: As of the most recent reporting, no broad in-the-wild exploitation campaign or public proof-of-concept has been widely confirmed; still, the presence of PoCs historically follows quickly for untrusted search path bugs — treat the risk as urgent.

Blast-radius considerations​

• Single host compromise: direct — system-managed admin tokens allow arbitrary local modifications and service installs.
• Lateral movement: once a host is escalated to SYSTEM-equivalent privileges, credential theft and lateral movement become far easier.
• Supply-chain and management servers: if elevation occurs on an imaging or management server, the risk broadens because attackers with admin-level control of management planes can push malicious configuration changes widely.

Operational impact​

• Compatibility testing: Administrator Protection changes how elevation flows behave and some legacy installers or scripts may need adjustment. Administrators should pilot patches in test rings before broad deployment to catch any compatibility regressions.
• Reboot requirements: security fixes that update elevation-related components will likely require reboots and a coordinated maintenance window.
• Detection and forensics: EoP exploitation involving search-path hijacking may leave subtle traces (creation of unexpected DLLs or executables in search-path folders, new service registrations, unusual process load events). Detection rules should look for unexpected writes to directories that are in process search orders and for new child-processes launched inside Administrator Protection elevation contexts.

---

Recommended immediate actions (prioritized)​

• Apply vendor updates now
• Map CVE-2025-60718 to the correct KB(s) for each Windows 11 build in the estate using Microsoft’s Security Update Guide, then deploy those KBs in the normal test → pilot → broad rollout cadence. The vendor update is the only guaranteed fix.
• Prioritize hosts with local-network exposure or untrusted share mounts
• Systems that mount remote shares or allow users to run applications from network paths should be prioritized because untrusted search path exploits commonly leverage network shares and mapped drives.
• Harden local accounts and reduce attack surface
• Enforce the principle of least privilege across endpoints.
• Limit the number of local administrator accounts; use managed privileged access solutions (such as Privileged Access Workstations, LAPS, or centralized PAM integrations) to reduce standing admin exposure.
• Monitor and hunt for indicators
• Hunt for newly created DLLs or executables in directories that are searched by system processes (current directories, TEMP folders, or mapped network paths).
• Monitor execution events from processes that participate in Administrator Protection flows and watch for unexpected child processes launched under admin tokens.
• Block common exploitation primitives where feasible
• Consider restricting execution from user-temporary folders and network shares by using application control policies (Windows Defender Application Control, Applocker, or third-party allowlists).
• Use EDR policies to block or at least alert on processes that load unsigned modules into elevated contexts.
• Review system image/build processes
• Ensure build servers and image-generation procedures do not expose writable directories in the search path for system services; inject only signed and fully qualified dependencies.

---

Detection guidance and indicators of compromise​

• Unexpected DLL/executable files appearing in search-path locations that are writable by non-admin users.
• Elevated process that loads modules from non-system locations (monitor module load events and correlate with expected module paths).
• Creation of new services, scheduled tasks or autoruns by low-privileged users shortly before administrative operations are requested.
• Unusual Administrator Protection prompts or elevation flows triggered at odd times or by unexpected processes.
• Forensic triage: collect module load traces, process creation trees, and timeline for file writes in the candidate search-path directories.

EDR vendors frequently publish detection telemetry and YARA-like rules for untrusted search path behavior; add those signatures in tandem with custom host-based rules for module-load anomalies. Early community feedback suggests detection opportunities are rich because the exploitation pattern requires the adversary to place files in locations that are often monitored or can be restricted.

---

Technical analysis: how untrusted search path exploits are turned into EoP​

• The privileged elevation flow builds or accepts a path to a dependency without enforcing a fully qualified absolute, signed path.
• The process enumerates the search order (current dir → executable dir → system paths → PATH entries → network shares) and selects the first matching filename.
• An attacker who can place a file with that name earlier in the search order causes the loader to open and map attacker-controlled code into the privileged process space.
• Once mapped within the admin token’s process, the attacker can execute arbitrary code in that privileged context, perform token theft or swap, or install services and persistence mechanisms.

Past incidents show that even when vendors introduce SafeDllSearchMode defaults or call LoadLibraryEx with safe flags, single overlooked call sites or temporary helper executables can still be abused. The remedy is always explicit path resolution and integrity validation of loaded artifacts combined with minimizing writable locations in search orders and enforcing execution policies.

---

Strengths and limits of the fix and broader risks​

Notable strengths​

• Centralized fix point: Because Administrator Protection is a consolidated elevation gate, patching the bug in that component removes a broad class of potential bypasses in a single update.
• Architectural intent: Administrator Protection remains a strong defensive model for reducing persistent admin token exposure and preventing many historical UAC bypasses.
• Vendor response: Microsoft’s advisory and update guidance enable administrators to map and remediate vulnerable builds through standard patch management workflows.

Potential limitations and residual risk​

• Local prerequisite: this CVE is local-authenticated, which reduces mass-exposure compared with network wormable RCEs — but it is very effective at post-compromise escalation in targeted attacks.
• Compatibility and detection gaps: legacy apps and automation that rely on older elevation assumptions may encounter breakages; hurried or misconfigured deployments risk operational disruption and may blind defenders if logs are not centrally collected.
• Emergence of PoCs: untrusted search path issues historically attract PoCs quickly; even if no PoC exists now, expect public exploit code to appear — detect-and-respond preparations must assume eventual proof-of-concept availability.

---

Long-term recommendations (policy and architecture)​

• Advance to least-privilege by default: continue moving administrative activity behind just-in-time workflows and dedicated privileged access endpoints (Privileged Access Workstations).
• Enforce signed-load policies: mandate signed drivers and signed binaries where feasible and enforce module-load policies in high-risk environments.
• Reduce writable locations in process search paths: ensure service and system processes do not accept search paths that include writable locations (user temp folders, current working directory, or unvetted network mounts).
• Centralize and harden update pipelines: build verification and rapid deployment processes so critical security updates for elevation paths can be tested and deployed rapidly without wide disruption.
• Complement updates with telemetry: layer EDR/EDR-style telemetry to monitor module loads and elevation flows; instrument Administrator Protection flows with telemetry that can be centrally queried for anomalies.

---

What was verified and what remains unconfirmed​

• Verified from vendor and independent tracking feeds:
• CVE identifier CVE-2025-60718 exists and is listed in Microsoft’s Security Update Guide; vendor-provided updates are indicated for Windows 11 builds.
• Public trackers assign a CVSS v3.1 base score of 7.8 and describe the weakness as an untrusted search path in Administrator Protection with a local attack vector.
• Unverified / flagged for caution:
• Public proof-of-concept code or active, widespread exploitation has not been broadly confirmed in public feeds at the time of writing; community trackers report no large-scale in-the-wild exploitation, but PoCs could appear rapidly given the class of the flaw. Treat any unconfirmed exploitation claims cautiously until corroborated by vendor telemetry or trusted threat-intel feeds.

---

Summary and final recommendations​

CVE-2025-60718 is a significant, high-priority local elevation-of-privilege vulnerability that targets the new Administrator Protection elevation model in Windows. The root cause — an untrusted search path in Administrator Protection — maps to a classic and understood exploitation pattern that can convert local footholds into full administrative control once an attacker can place attacker-controlled modules in a search path consumed by the elevation flow. Microsoft has published an advisory and updates; independent trackers mirror the vendor details and assign a CVSS score of 7.8. Administrators must prioritize applying the vendor KBs mapped to their specific Windows 11 builds, harden local account exposure, restrict writable directories in process search orders, and add detection rules for suspicious module loads or elevation-path artifacts. Action checklist (quick)

• Map CVE-2025-60718 → vendor KB(s) for your Windows 11 builds and schedule updates immediately.
• Prioritize hosts that mount network shares or allow user-writable locations in process search orders.
• Enforce least privilege, tighten admin account counts, and enable endpoint allowlisting where possible.
• Deploy EDR hunts for anomalous module loads and unexpected files in search-path directories.
• Test Administrator Protection behavior and patched images in a pilot ring before broad rollout to catch compatibility regressions.

CVE-2025-60718 demonstrates the paradox of platform hardening: consolidating security into a single protective gate reduces overall attack surface — but any vulnerability within that gate becomes highly valuable to attackers. The immediate remedy is clear: apply the vendor fix and harden the local environment. The strategic lesson is equally clear: keep attack surface contraction efforts coupled with aggressive code review and runtime integrity checks for any new centralized security control.

---

Source: MSRC Security Update Guide - Microsoft Security Response Center