Introduction
A newly disclosed spoofing vulnerability in the Microsoft Defender portal could show falsified alerts or misleading status indicators to administrators who rely on the portal for real-time security decisions. CVE-2025-62459, reported on November 20, 2025, lets attackers manipulate the portal's presentation layer. That could deceive security staff and disrupt incident response workflows. The issue has a CVSS score of 8.3 and is classified as CWE-79 (Cross-Site Scripting), and it matters most to organizations that depend on Microsoft Defender for enterprise security operations.
Technical information
CVE-2025-62459 is a presentation-layer vulnerability in the Microsoft Defender portal, caused by improper neutralization of user input (CWE-79). Attackers can use it to inject content that spoofs trusted UI elements in the portal. This could mislead administrators with falsified threat alerts, remediation recommendations, or system status messages.
The flaw triggers when the portal renders attacker-controlled input without sanitizing it. A typical attack would use a crafted URL or input field: when an authenticated user opens or views it, the portal displays the manipulated content. The attack requires user interaction and does not exploit backend logic or data storage. No public code snippets or exploit payloads are available at this time.
Affected systems and versions
- Product: Microsoft Defender portal
- No specific version numbers or ranges have been disclosed in public sources as of November 20, 2025
- Only configurations where administrators interact with the Defender portal UI are affected
Vendor security history
Microsoft has fixed similar vulnerabilities in its Defender product line before, including spoofing and XSS issues such as CVE-2025-26685 (Defender for Identity spoofing). The company has an established security response process, with regular Patch Tuesday releases and out-of-band updates for critical vulnerabilities. For high-severity issues in its security products, Microsoft usually publishes advisories and patches promptly.
