CVE-2025-59230

Exploited in the Wild ✓ Confirmed 0-Day ★ Google Project Zero
Triaged: March 3, 2026 8 articles
VulnLookup ↗ NVD ↗ MITRE ↗ Advisory ↗ P0 Sheet ↗ CISA KEV ↗

EPSS Score

Source: FIRST.org · 2026-05-24
4.97%
probability
This CVE has a 4.97% probability of being exploited in the next 30 days.
0% Top 89.8th percentile of all CVEs 100%
CVSS score unavailable
Neither CIRCL nor NVD returned a CVSS score for this CVE. View on VulnerabilityLookup ↗

Description

Project Zero
Improper access control

Attack Intelligence

Google Project Zero

Patched
Oct. 14, 2025
Reported by
Microsoft Threat Intelligence Center (MSTIC) & Microsoft Security Response Center (MSRC)
Root Cause Analysis
???

Signal Intelligence

Confidenceⓘ
92%
EPSS 4.97%
Mentions 8
Last Seen Jun 09, 2026

CNA Information

Analyst Note

This CVE is confirmed as a zero-day with strong supporting evidence: it appears in Google Project Zero, has been included in Microsoft's official patch Tuesday releases, and is documented across multiple reputable security sources (TheHackerNews, BleepingComputer) confirming active exploitation. The HIGH severity rating (CVSS 7.8) combined with the privileged escalation nature of the vulnerability and documented unofficial patches validates the confirmed status.

Threat Actors 10

The Shadow Brokers
apt_group 🇷🇺 RU
Infy
apt_group Information theft and espionage 🇮🇷 IR
RTM
apt_group Financial crime 🇷🇺 RU
Mysterious Elephant
apt_group Information theft and espionage 🇮🇳 IN
Rocke
apt_group 🇨🇳 CN
Red October
apt_group 🇷🇺 RU
ToddyCat
apt_group Information theft and espionage 🇨🇳 CN
Pat Bear
apt_group 🇸🇾 SY
Mana Team
apt_group 🇨🇳 CN
Operation Shadow Force
apt_group 🇨🇳 CN

Triage Info

Decided atMar 03, 2026