The very software you installed to stay safe online could be the unlock code that gives an attacker complete control of your Windows computer.
Who's Affected — and Why It Matters
Norton Secure VPN is one of the most recognizable consumer VPN products on the market, distributed directly through the Microsoft Store — a channel millions of everyday Windows users trust precisely because it's supposed to be a safe, curated storefront. The vulnerability, tracked as CVE-2025-58074 and rated HIGH severity, affects Windows users who install or reinstall Norton Secure VPN through the Microsoft Store. Norton's parent company, Gen Digital, has a consumer security product install base measured in the hundreds of millions worldwide. Even a fraction of those users represents an enormous potential attack surface.
The real-world stakes aren't abstract. On a shared office computer, a university lab machine, a family PC — anywhere multiple people log in with different permission levels — a low-level account that should only be able to browse the web or write documents could be weaponized into a full administrator account. That means access to every file, every credential stored on the machine, and the ability to install malware that persists long after the original attack.
What's Actually Happening — In Plain English
Imagine a building under renovation where the construction crew briefly props open a secure door to carry in materials. A savvy trespasser who knows the schedule could slip inside during that window and swap out something important — say, replace the master key hanging on a hook with a copy of their own. That's essentially what this vulnerability allows. When Norton Secure VPN is being installed through the Microsoft Store, the installer momentarily handles files in a way that a non-administrator user on the same machine can interfere with. An attacker with a basic, restricted account can race to replace those files before the installer finishes its work.
Here's where it gets dangerous: the installer runs with elevated, system-level privileges — the highest level of trust a Windows machine grants. When it picks up and acts on those swapped-out files, it's doing so with its own high-powered credentials, not the attacker's limited ones. The attacker can use this moment to cause the installer to delete files it was never supposed to touch. Deleting the right system files in the right sequence is a well-documented technique for forcing Windows to grant elevated access — a classic "delete your way to admin" maneuver.
The end result: someone who started with barely any permissions on your computer — maybe a guest account, maybe a compromised low-privilege application — can emerge from this process with the same access as the machine's owner or a system administrator. From there, they can read your private files, steal saved passwords, install persistent backdoors, or pivot to attack other machines on your network. The cruel irony is that the attack is triggered by the act of installing security software.
The Technical Detail That Matters
Security researchers and incident responders should note the specific vulnerability class at play here: this is a TOCTOU (Time-of-Check to Time-of-Use) race condition embedded in a privileged installation process, enabling arbitrary file deletion via a file-replacement substitution attack. The CVSS score of 8.8 (HIGH) reflects the low attack complexity and low privilege requirements — an attacker doesn't need special tools or a sophisticated setup, just local access and timing. The attack surface is the installation pipeline of a Microsoft Store-distributed package, meaning standard app sandboxing assumptions do not fully mitigate the risk here.
Has This Been Exploited in the Wild?
As of publication, no active exploitation has been confirmed. There are no known campaigns, no reported victims, and no public proof-of-concept exploit code circulating in the research community. That's the good news. The less comfortable news is that vulnerabilities of this class — local privilege escalation through installer race conditions — are a known favorite of post-exploitation toolkits. Once an attacker has any foothold on a machine (via phishing, a browser exploit, or a compromised app), a local privilege escalation bug like this becomes the elevator they ride to full control. The window between "vulnerability disclosed" and "incorporated into attacker toolkits" has historically been short. Security teams should treat the absence of current exploitation as a head start, not a reason to delay.
The vulnerability was assigned the CVE identifier CVE-2025-58074. Gen Digital (Norton's parent company) has been notified through standard disclosure channels. Specific researcher attribution and full disclosure timeline details were not publicly available at time of publication.
What You Should Do Right Now
Whether you're a home user or an IT administrator managing a fleet of machines, the steps are the same — and they're straightforward:
- Update Norton Secure VPN immediately. Open the Microsoft Store on your Windows machine, navigate to Library → Get Updates, and ensure Norton Secure VPN is running the latest available version. Gen Digital typically pushes patches through the Store automatically, but don't wait for the background updater — force the check now. If you manage devices via MDM or endpoint management tools, push the updated package to all endpoints as a priority task.
- Audit who has local access to shared machines. This vulnerability requires local access — someone must be logged in, or an existing process must already be running on the machine. Review user accounts on any shared Windows systems and remove or restrict accounts that don't need to be there. On Windows 10/11, go to Settings → Accounts → Other Users and remove any accounts that are no longer needed. Reducing local access reduces your exposure to this entire class of attack.
- Enable Windows Defender Credential Guard and monitor for privilege escalation indicators. On Windows 11 Enterprise or Windows 10 version 1511 and later (Enterprise/Education editions), enable Credential Guard via Group Policy under Computer Configuration → Administrative Templates → System → Device Guard. Additionally, configure your endpoint detection tools to alert on unexpected file deletions in system directories during installation processes — a behavioral signature that would catch exploitation of this specific bug in action.
CVE: CVE-2025-58074 | CVSS: 8.8 HIGH | Platform: Windows | Category: Privilege Escalation | Active Exploitation: None confirmed as of publication