VulnerabilityAnalyzed
CVE-2025-30394
Sensitive data storage in improperly locked memory in Remote Desktop Gateway Service allows an unauthorized attacker to deny service over a network.
MEDIUM 5.9EPSS 30.5%
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 30.5%, higher than 98% of all known CVEs. Patch or mitigate before the next change window.
Description
Sensitive data storage in improperly locked memory in Remote Desktop Gateway Service allows an unauthorized attacker to deny service over a network.
- CVSS 3.1
- 5.9 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 30.50% probability · 98th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-591, CWE-362
- Affected
- microsoft/windows server 2012 · microsoft/windows server 2016 · microsoft/windows server 2019 · microsoft/windows server 2022 · microsoft/windows server 2022 23h2 · microsoft/windows server 2025
- Source
- secure@microsoft.com
References
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.