CVE-2025-21355: High Missing Authentication in Microsoft Bing

CVE-2025-21355 is a high severity missing authentication flaw (CVSS 8.6) in Microsoft Bing. The record says an unauthorized attacker could execute code over a network. It lists no versions or fix, so read the Microsoft advisory to see whether any action is needed on your side.

What's affected

• Product: Microsoft Bing
• Weakness: missing authentication for a critical function (CWE-306)
• CVSS: 8.6 (High), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
• Published: 2025-02-19

The record is short. It does not list affected versions, fixed versions or a customer action, and the Microsoft update guide page behind it needs JavaScript, so I could not read it from here. Do not assume anything about whether you must do something until you have read the advisory yourself.

The vector shows network access, no privileges and no user interaction, with a scope change and a high confidentiality impact. The CISA Known Exploited Vulnerabilities flag is false for this CVE, and none of the pages I read report active exploitation.

How to check if you're exposed

There is no package or version to query from the record, so the check is to read the advisory and match it to what you use.

1. Open the Microsoft Security Response Center entry for CVE-2025-21355 in a browser and read the FAQ and any stated customer action.
2. Decide whether you run Bing components inside your own environment, for example in applications or services that integrate with Bing, or only use Bing as a service.
3. If the advisory names a product or version you run, check that version using the normal Microsoft update tooling for it.
4. If the advisory says the issue is fixed on the service side, note the date and record that no action was needed.

Keep a record of what you found and when. Auditors and customers ask this sort of question months later.

What to do now

1. Read the Microsoft advisory for CVE-2025-21355 in full.
2. Decide whether anything you run is in scope, and write down the answer with the date.
3. If the advisory names a customer action, assign it an owner and a due date.
4. If your own applications call Bing services, check that they authenticate every call and handle errors safely.
5. Add the CVE to your tracking system so the decision is easy to find later.

Why it matters

The weakness is CWE-306, missing authentication for a critical function. A function that does something important can be called without proving who is calling. When that function can run code, the missing check is the whole problem.

This is a good example of an entry where the score alone does not tell you what to do. A high score on a hosted service and a high score on software you install call for different responses. The honest answer from the record is that the facts are thin, and the advisory is the authority. The habit to build is to write down the decision, even when it is that no action is needed.

Quick check

Sources

• Microsoft Security Response Center entry (needs JavaScript to read)
• NVD record for CVE-2025-21355

Last reviewed: 19 October 2026.