Race condition in Microsoft Internet Information Services (IIS) and Windows Server - CVE-2025-55231
Published: August 22, 2025
Vulnerability identifier: #VU114366
CSH Severity: High
CVSS v4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-55231
CWE-ID: CWE-362
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to a race condition in Windows Storage-based Management Service. A remote attacker can send specially crafted HTTP requests to the affected web server, trigger a race condition and execute arbitrary code on the system.
Note, successful exploitation of the vulnerability requires that the user restarts the affected service.
Affected software
Microsoft Internet Information Services (IIS)
Windows Server
Windows Server
How to mitigate CVE-2025-55231
Install updates from vendor's website.
Windows Server - addressed in versions 2012 R2 6.3.9600.22767, 2016 10.0.14393.8416, 2019 10.0.17763.7783, 2022 10.0.20348.4161, 2025 10.0.26100.6563