Microsoft Windows Defender Firewall Vulnerabilities Allow Privilege Escalation

Microsoft has disclosed four newly discovered vulnerabilities in its Windows Defender Firewall Service that could enable privilege escalation on affected Windows systems. The flaws, tracked as CVE-2025-53808, CVE-2025-54104, CVE-2025-54109, and CVE-2025-54915, were disclosed on 9 September 2025 and share similar characteristics, with all four involving Type Confusion (CWE-843) and an elevated-risk impact on confidentiality, integrity, and availability.

Exploitation requires local access, and successful attacks could allow threat actors to execute code at SYSTEM level, bypassing normal security boundaries. The vulnerabilities reside in the Windows Defender Firewall Service executable running with elevated privileges, giving an attacker logging on locally the ability to take control, potentially disabling security controls or moving laterally.

According to Microsoft, patches are available through the September 2025 security updates, and administrators are urged to apply them, restrict local account logins, monitor event logs, and enforce least-privilege policies to minimise impact. The CVSS 3.1 base score is 6.7 with a temporal score of 5.8 for each flaw, with attack vector local (AV:L), low complexity (AC:L), high privileges required (PR:H), and no user interaction needed (UI:N).