CVE-2025-30397: Microsoft Scripting Engine type confusion allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityIt is in CISA KEV with active exploitation, high EPSS, and remote code execution impact across a wide Windows install base.

What it is

A type confusion flaw in the Microsoft Scripting Engine lets an unauthorized attacker execute code over a network. It affects a broad range of Windows client and server releases, and CISA added it to the Known Exploited Vulnerabilities catalog on the publication date, so it is being exploited in the wild.

Impact

Successful exploitation gives the attacker code execution in the context of the affected scripting component, with high confidentiality, integrity and availability impact.

Attack surface

Reached over the network (AV:N) with no privileges required (PR:N), but the CVSS vector requires user interaction (UI:R), so a victim must open or trigger the crafted content. The record does not specify the exact delivery mechanism.

Exploitation

Listed in CISA KEV with a 2025-06-03 remediation due date, and EPSS is 0.26835 (97.9th percentile), indicating active exploitation and elevated likelihood. A third-party reference is tagged Exploit.

What to do

• Apply the Microsoft security update for CVE-2025-30397 across all affected Windows client and server versions.
• Prioritize internet-facing and user-workstation systems, and meet the CISA KEV due date of 2025-06-03.
• If patching cannot be completed immediately, apply the vendor mitigations or discontinue use of the affected product per BOD 22-01 guidance.
• Reduce exposure by restricting execution of untrusted script content and limiting the scripting engine's reach from email, web and document vectors.

Detection

• Monitor for scripting engine processes spawning unexpected child processes or making unusual network connections.
• Hunt for crashes or anomalous memory behavior in scripting engine components that may indicate type confusion attempts.
• Review endpoint telemetry for documents or web content that trigger scripting engine execution outside normal user workflows.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.