CVE Alert: CVE-2025-54108 – Microsoft – Windows Server 2025 (Server Core installation)

Risk verdict

High risk of local privilege escalation on affected Windows platforms; exploitation is not confirmed in the wild, but the combination of local access, low-privilege prerequisites, and total impact warrants prompt attention.

Why this matters

Successful escalation could yield SYSTEM-level control, enabling persistence, credential access, and lateral movement within an environment. CAMSVC underpins capability management, so misuse could undermine security controls across connected services and disrupt identities and authorisations.

Most likely attack path

An attacker with local access and low privileges triggers a race condition/use-after-free in CAMSVC, exploiting improper synchronization to elevate rights. No user interaction is required, increasing feasibility for remote-adjacent attackers who gain a foothold on a host. If successful, attacker can gain high-integrity access on the machine, enabling further abuse or persistence with limited preconditions for lateral movement.

Who is most exposed

Endpoints running Windows Server 2025 (Server Core) or Windows 11 24H2 (ARM64/x64) with CAMSVC active are exposed; organisations relying on local admin accounts or frequent remote administration on servers/workstations are at greater risk.

Detection ideas

• Recurrent CAMSVC process crashes or rapid restarts
• Local privilege escalation attempts or unexpected token elevation events
• Unusual CPU/memory spikes in CAMSVC or related service activity
• Creation of anomalous or unexpected privileged processes or tokens

Mitigation and prioritisation

• Apply the official patch to affected versions (10.0.26100.6584+); schedule urgent deployment.
• If patching is delayed, implement strict local-privilege controls, restrict admin access, and reduce lateral movement avenues.
• Enable enhanced monitoring of CAMSVC activity and privilege-escalation events; review service permissions and harden SCM-related configurations.
• Verify integrity of CAMSVC binaries and related CONFIG changes; perform post-change validation in a test environment.
• Treat as priority 1 if exploitation evidence or EPSS indicators emerge.