CISA Warns of Active Exploitation of Windows Kernel 0-Day Enabling Privilege Escalation

CISA warns of active exploitation of a zero-day vulnerability in Microsoft Windows tracked as CVE-2025-62215, which affects the Windows Kernel and could allow a local attacker to escalate to SYSTEM-level privileges. According to CISA, the flaw is a race condition in the core of Windows that, if exploited, would give an attacker full control of the affected device and could enable data theft or disruption.

The alert notes that researchers have observed hackers exploiting this vulnerability in the wild, and that gaining SYSTEM access would let an attacker install programs, view or modify data, or create new accounts with full rights. Patch guidance urges applying Microsoft patches and mitigations as soon as available, with additional recommendations for cloud users under BOD 22-01 and, if patches cannot be applied, discontinuing use of the impacted services or systems until a fix is released.

The vulnerability is described as zero-day, meaning there was no prior fix before exploitation, placing unpatched systems at heightened risk for organisations and individuals alike.