CVE-2025-58074

Privilege escalation during the installation of Norton Secure VPN via the Microsoft Store

State: Published
Severity: 8.8 High
Published: May 4, 2026
Updated: May 29, 2026
Reserved: Sep 19, 2025

Description

A privilege escalation vulnerability exists during the installation of Norton Secure VPN via the Microsoft Store. A low-privilege user can replace files during the installation process, which may result in deletion of arbitrary files that can lead to elevation of privileges.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H	GEN

Weaknesses

CWE-1386 Insecure Operation on Windows Junction / Mount Point

Affected Products

Product	Versions
Norton Secure VPNGen Digital	6.5.0.59Affected

References

https://talosintelligence.com/vulnerability_reports/TALOS-2025-2276vendor-advisory
https://support.norton.com/sp/en/me/home/current/solutions/v20250301180004520related
https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2276

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.