Microsoft has issued an updated warning for a critical security vulnerability in Active Directory Domain Services, tracked as CVE-2025-21293.

This flaw could permit an attacker who has already gained initial access to a system to escalate their privileges, potentially gaining complete control over the affected domain controller and undermining the security of the network infrastructure.

The vulnerability is categorized as an “Elevation of Privilege” issue stemming from an improper access control weakness, formally identified as CWE-284.

According to Microsoft’s advisory, an attacker who successfully exploits this flaw could elevate their privileges to the SYSTEM level.

Gaining SYSTEM privileges is the highest level of access on a Windows system, allowing an attacker to perform any action without restriction.

This includes installing malicious software, modifying or deleting critical data, and creating new administrative accounts, which could be used to establish persistence within the network.

The vulnerability was initially reported on January 14, 2025, with Microsoft providing an update on September 9, 2025, to offer further clarity.

Exploit Conditions And Assessment

Microsoft has assessed the exploitability of this vulnerability as “Exploitation Less Likely.” A key factor in this assessment is the attack vector, which requires an attacker to first log on to the target system.

This means the flaw cannot be exploited remotely by an unauthenticated user. The adversary must possess valid credentials, which could be obtained through tactics like phishing, credential stuffing, or exploiting a separate vulnerability.

Once authenticated, the attacker would need to run a specially crafted application to trigger the flaw and escalate their privileges.

At the time of the latest update, the vulnerability had not been publicly disclosed, and there were no reports of it being actively exploited in the wild.

Despite the prerequisite of prior access, the severity of the potential impact makes patching a critical priority for IT administrators.

An attacker with SYSTEM-level control on a domain controller can compromise the entire Active Directory forest, putting all domain-joined resources at risk.

Organizations are strongly advised to apply the security updates released by Microsoft to protect their domain controllers from this threat.

This incident serves as a reminder that a defense-in-depth security strategy, which includes regular patching, network segmentation, and monitoring for anomalous user activity, is essential to defend against multi-stage attacks that leverage local privilege escalation vulnerabilities.

Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.

The post Microsoft Warns of Active Directory Domain Services Vulnerability, Let Attackers Escalate Privileges appeared first on Cyber Security News.

Sophos has resolved an authentication bypass vulnerability in its AP6 Series Wireless Access Points that could allow attackers to gain administrator-level privileges.

The company discovered the issue during internal security testing and has released a firmware update to address it.

The security vulnerability allows an attacker with network access to the access point’s management IP address to bypass authentication controls. A successful exploit grants the threat actor administrator privileges on the affected device.

This elevated access could be leveraged to control the access point, intercept or manipulate network traffic, disrupt wireless connectivity, or use the compromised device as a pivot point to launch further attacks within the network.

Sophos reported that the vulnerability was found by its own team, highlighting a proactive approach to product security.

The nature of the flaw, requiring access to the management interface, suggests that the primary risk is from attackers already on the local network.

Sophos Wireless Access Points Vulnerability

This vulnerability affects Sophos AP6 Series Wireless Access Points running firmware versions prior to 1.7.2563 (MR7). To address the issue, Sophos has included a fix in firmware version 1.7.2563 (MR7), which was released after August 11, 2025.

Administrators managing these devices are urged to verify that their access points are running this version or a later one to ensure they are protected.

Any organization using older firmware versions remains vulnerable and must upgrade to receive the security fix and shield their networks from potential exploitation.

For most customers, the remediation process is automatic. Sophos AP6 devices are configured by default to install updates automatically, meaning the patched firmware will be applied without requiring manual intervention.

This default policy ensures that the majority of users are protected seamlessly. However, customers who have intentionally opted out of automatic updates must take manual action.

These users are required to upgrade their AP6 Series firmware to version 1.7.2563 (MR7) or a more recent version to apply the patch.

Failing to update leaves the wireless access points exposed to this critical authentication bypass risk.

Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.

The post Sophos Wireless Access Points Vulnerability Let Attackers Bypass Authentication appeared first on Cyber Security News.