Microsoft has addressed a critical security flaw in its Bing search engine, tracked as CVE-2025-21355, which could have allowed unauthorized attackers to execute arbitrary code remotely. While Microsoft has not disclosed specific technical details to prevent further exploitation, security analysts speculate the vulnerability resided in Bing’s API or cloud service layer. The vulnerability, classified as a Missing authentication for a Critical Function flaw, posed significant risks to organizations and users relying on Bing’s infrastructure. The absence of required authentication made this vulnerability particularly dangerous, as attackers could launch large-scale attacks without needing to compromise user credentials. As a core component of Microsoft’s services, Bing integrates with enterprise tools like Microsoft 365, SharePoint, and Azure Active Directory. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. Attackers could exploit the flaw over a network to execute malicious code without requiring user interaction or prior authentication. Microsoft confirmed the flaw affected all Bing service tiers, including consumer and enterprise deployments. With a maximum CVSS severity score of 9.8, this remote code execution (RCE) vulnerability marked one of the most severe threats to Microsoft’s ecosystem this year. Microsoft encourages organizations to subscribe to its Security Update Guide for real-time alerts on emerging threats. CVE-2025-21355 originated from inadequate authentication mechanisms in a critical Bing service component. This would enable threat actors to compromise backend systems, manipulate search results, or exfiltrate sensitive data hosted on Microsoft’s infrastructure. The flaw’s network-based attack vector suggests it could have been exploited via specially crafted requests to unpatched servers, bypassing authentication checks to gain SYSTEM-level privileges.
This Cyber News was published on cybersecuritynews.com. Publication date: Thu, 20 Feb 2025 01:45:10 +0000