Out-of-bounds read in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

The remote Windows host is missing security update 5068779. It is, therefore, affected by multiple vulnerabilities

  - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands.     (CVE-2025-60724, CVE-2025-60714, CVE-2025-60715, CVE-2025-62452)

  - An information disclosure vulnerability. An attacker can exploit this to disclose potentially sensitive information.     (CVE-2025-59509, CVE-2025-59513, CVE-2025-60706, CVE-2025-62208, CVE-2025-62209)   
  - An elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges.
    (CVE-2025-59505, CVE-2025-59506, CVE-2025-59507, CVE-2025-59508,     CVE-2025-59511, CVE-2025-59512, CVE-2025-59514, CVE-2025-59515,     CVE-2025-60703, CVE-2025-60704, CVE-2025-60705, CVE-2025-60707,     CVE-2025-60709, CVE-2025-60713, CVE-2025-60716, CVE-2025-60717,     CVE-2025-60719, CVE-2025-60720, CVE-2025-62213, CVE-2025-62215,     CVE-2025-62217, CVE-2025-62218, CVE-2025-62219     )

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5068908. It is, therefore, affected by multiple vulnerabilities

  - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands.
   (CVE-2025-60724, CVE-2025-60714, CVE-2025-60715, CVE-2025-62452)

  - An elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges.
    (CVE-2025-59505, CVE-2025-59511, CVE-2025-59512, CVE-2025-59514, CVE-2025-60703,     CVE-2025-60705, CVE-2025-60707, CVE-2025-60709, CVE-2025-60713, CVE-2025-60720,     CVE-2025-60704, CVE-2025-59506, CVE-2025-59507, CVE-2025-59508, CVE-2025-59515,     CVE-2025-60716, CVE-2025-60717, CVE-2025-60719, CVE-2025-62213, CVE-2025-62215,     CVE-2025-62217, CVE-2025-62218, CVE-2025-62219)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5068787. It is, therefore, affected by multiple vulnerabilities

  - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands.     (CVE-2025-60724, CVE-2025-60714, CVE-2025-60715, CVE-2025-62452)   
  - An information disclosure vulnerability. An attacker can exploit this to disclose potentially sensitive information.
    (CVE-2025-59509, CVE-2025-59513, CVE-2025-60706, CVE-2025-62208, CVE-2025-62209)   
  - An elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges.
    (CVE-2025-59505, CVE-2025-59506, CVE-2025-59507, CVE-2025-59508,     CVE-2025-59511, CVE-2025-59512, CVE-2025-59514, CVE-2025-59515,     CVE-2025-60703, CVE-2025-60704, CVE-2025-60705, CVE-2025-60707,     CVE-2025-60709, CVE-2025-60713, CVE-2025-60716, CVE-2025-60717,     CVE-2025-60719, CVE-2025-60720, CVE-2025-62213, CVE-2025-62215,     CVE-2025-62217)


Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5068781. It is, therefore, affected by multiple vulnerabilities

  - An information disclosure vulnerability. An attacker can exploit this to disclose potentially sensitive information.     (CVE-2025-59509, CVE-2025-59513, CVE-2025-60706, CVE-2025-62208, CVE-2025-62209)   
  - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands.     (CVE-2025-60724, CVE-2025-60714, CVE-2025-60715, CVE-2025-62452)

  - An elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges.
    (CVE-2025-59505, CVE-2025-59506, CVE-2025-59507, CVE-2025-59508,     CVE-2025-59511, CVE-2025-59512, CVE-2025-59514, CVE-2025-59515,     CVE-2025-60703, CVE-2025-60704, CVE-2025-60705, CVE-2025-60707,     CVE-2025-60709, CVE-2025-60716, CVE-2025-60717, CVE-2025-60719,     CVE-2025-60720, CVE-2025-62213, CVE-2025-62215, CVE-2025-62217,     CVE-2025-62218, CVE-2025-62219)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5068865. It is, therefore, affected by multiple vulnerabilities

  - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands.
    (CVE-2025-60724, CVE-2025-60715, CVE-2025-62452)

  - An elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges.
  (CVE-2025-59505, CVE-2025-59511, CVE-2025-59512, CVE-2025-59514, CVE-2025-60703, CVE-2025-60705,   CVE-2025-60707, CVE-2025-60709, CVE-2025-60713, CVE-2025-60714, CVE-2025-60720, CVE-2025-60704,   CVE-2025-59506, CVE-2025-59507, CVE-2025-59508, CVE-2025-59515, CVE-2025-60716, CVE-2025-60717,   CVE-2025-60719, CVE-2025-62213, CVE-2025-62215, CVE-2025-62217, CVE-2025-62218, CVE-2025-62219)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5068907. It is, therefore, affected by multiple vulnerabilities

  - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands.
    (CVE-2025-60724, CVE-2025-60714, CVE-2025-60715, CVE-2025-62452)

  - An elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges.
    (CVE-2025-59505, CVE-2025-59506, CVE-2025-59512, CVE-2025-59514,     CVE-2025-60703, CVE-2025-60704, CVE-2025-60705, CVE-2025-60709,     CVE-2025-60719, CVE-2025-60720, CVE-2025-62213, CVE-2025-62217)

  - A denial of service (DoS) vulnerability. An attacker can exploit this issue to cause the affected component to deny system or application services.
    (CVE-2025-59510)     Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5068905. It is, therefore, affected by multiple vulnerabilities

  - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands.     (CVE-2025-60724, CVE-2025-60714, CVE-2025-60715, CVE-2025-62452)

  - An elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges.
    (CVE-2025-59505, CVE-2025-59506, CVE-2025-59512, CVE-2025-59514,     CVE-2025-60703, CVE-2025-60704, CVE-2025-60705, CVE-2025-60709,     CVE-2025-60719, CVE-2025-60720, CVE-2025-62213, CVE-2025-62217)

  - A denial of service (DoS) vulnerability. An attacker can exploit this issue to cause the affected     component to deny system or application services. (CVE-2025-59510)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5068791. It is, therefore, affected by multiple vulnerabilities

  - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands.     (CVE-2025-60724, CVE-2025-60714, CVE-2025-60715, CVE-2025-62452)

  - An information disclosure vulnerability. An attacker can exploit this to disclose potentially sensitive information.
    (CVE-2025-59509, CVE-2025-59513, CVE-2025-60706, CVE-2025-62208, CVE-2025-62209)

  - An elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges.
    (CVE-2025-59505, CVE-2025-59506, CVE-2025-59507, CVE-2025-59508,     CVE-2025-59511, CVE-2025-59512, CVE-2025-59514, CVE-2025-59515,     CVE-2025-60703, CVE-2025-60704, CVE-2025-60705, CVE-2025-60707,     CVE-2025-60709, CVE-2025-60713, CVE-2025-60716, CVE-2025-60717,     CVE-2025-60719, CVE-2025-60720, CVE-2025-62213, CVE-2025-62215,     CVE-2025-62217)   


Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5068861 or hotpatch 5068966. It is, therefore, affected by multiple vulnerabilities

  - Insertion of sensitive information into log file in Windows License Manager allows an authorized attacker     to disclose information locally. (CVE-2025-62208, CVE-2025-62209)

  - An elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges.
    (CVE-2025-59505, CVE-2025-59511, CVE-2025-59512, CVE-2025-59514, CVE-2025-60703, CVE-2025-60705,     CVE-2025-60707, CVE-2025-60709, CVE-2025-60713, CVE-2025-60720, CVE-2025-60704, CVE-2025-59506,     CVE-2025-59507, CVE-2025-59508, CVE-2025-59515, CVE-2025-60716, CVE-2025-60717, CVE-2025-60719,     CVE-2025-62213, CVE-2025-62215, CVE-2025-62217 )   
  - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands.     (CVE-2025-60724, CVE-2025-60715, CVE-2025-62452)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5068864. It is, therefore, affected by multiple vulnerabilities

  - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands.
    (CVE-2025-60724, CVE-2025-60714, CVE-2025-60715, CVE-2025-62452)   
  - An elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges.
    (CVE-2025-59505, CVE-2025-59506, CVE-2025-59507, CVE-2025-59508,     CVE-2025-59512, CVE-2025-59514, CVE-2025-60703, CVE-2025-60704,     CVE-2025-60705, CVE-2025-60709, CVE-2025-60713, CVE-2025-60719,     CVE-2025-60720, CVE-2025-62213, CVE-2025-62217)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5068909. It is, therefore, affected by multiple vulnerabilities

  - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands.     (CVE-2025-60724, CVE-2025-60715, CVE-2025-62452)   
  - An elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges.
    (CVE-2025-59514, CVE-2025-60703, CVE-2025-60704, CVE-2025-60705,     CVE-2025-60709, CVE-2025-60719, CVE-2025-60720, CVE-2025-62213,     CVE-2025-62217)

  - An information disclosure vulnerability. An attacker can exploit this to disclose potentially sensitive information. (CVE-2025-59513)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
274792	KB5068779: Windows 11 version 22H2 / Windows Server version 23H2 Security Update (November 2025)	Nessus	Windows : Microsoft Bulletins	high
274790	KB5068908: Windows Server 2008 R2 Security Update (November 2025)	Nessus	Windows : Microsoft Bulletins	critical
274789	KB5068787: Windows Server 2022 / Azure Stack HCI 22H2 Security Update (November 2025)	Nessus	Windows : Microsoft Bulletins	high
274787	KB5068781: Windows 10 version 21H2 / Windows 10 Version 22H2 Security Update (November 2025)	Nessus	Windows : Microsoft Bulletins	high
274785	KB5068865: Windows 11 version 22H2 / Windows 11 version 23H2 Security Update (November 2025)	Nessus	Windows : Microsoft Bulletins	high
274784	KB5068907: Windows Server 2012 Security Update (November 2025)	Nessus	Windows : Microsoft Bulletins	critical
274783	KB5068905: Windows Server 2012 R2 Security Update (November 2025)	Nessus	Windows : Microsoft Bulletins	critical
274782	KB5068791: Windows 10 version 1809 / Windows Server 2019 Security Update (November 2025)	Nessus	Windows : Microsoft Bulletins	high
274781	KB5068861: Windows 11 Version 24H2 / Windows Server 2025 Security Update (November 2025)	Nessus	Windows : Microsoft Bulletins	high
274780	KB5068864: Windows 10 Version 1607 / Windows Server 2016 Security Update (November 2025)	Nessus	Windows : Microsoft Bulletins	critical
274779	KB5068909: Windows Server 2008 Security Update (November 2025)	Nessus	Windows : Microsoft Bulletins	critical

Detections

Analytics

CVE-2025-60709

high

Tenable Plugins

high

critical

high

high

high

critical

critical

high

high

critical

critical