Remote Code Execution via Type Confusion in Microsoft Windows Scripting Engine (CVE‑2025‑30397)
What It Is – Microsoft’s Windows Scripting Engine contains a type‑confusion flaw that can be triggered by a specially‑crafted URL. An unauthenticated attacker can cause arbitrary code execution on the target system over the network.
Exploitability – The vulnerability is publicly disclosed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Proof‑of‑concept exploits have been observed, and the CVSS base score is rated High (8.8). No public exploit code is required beyond sending the malicious URL.
Affected Products – All supported versions of Microsoft Windows that include the Windows Scripting Engine (e.g., Windows 10, Windows Server 2019/2022) are vulnerable until the Microsoft security update is applied.
Why It Matters for Trust & Control Assurance
- Vulnerability Management – Demonstrates the need for continuous, automated patch monitoring to satisfy the control objective of timely remediation.
- Evidence of Due Diligence – Maintaining verifiable patch‑deployment logs provides defensible audit evidence across frameworks (NIST CSF, ISO 27001, etc.).
- Enterprise Buyer Expectations – Buyers increasingly request proof that organizations can detect, assess, and remediate critical flaws quickly; this incident highlights that requirement.
Recommended Actions
- Deploy Microsoft’s security update for CVE‑2025‑30397 immediately on all Windows endpoints.
- Verify patch rollout with an automated inventory tool and retain deployment logs as audit evidence.
- Review your vulnerability‑management control mapping to ensure it aligns with the “identify and remediate critical vulnerabilities” objective.
Source: CISA KEV – CVE‑2025‑30397