EPM Poisoning (CVE-2025-49760): Unpacking a Windows RPC Privilege Escalation Threat

A new flaw in Microsoft's Windows RPC Endpoint Mapper (EPM), tracked as CVE-2025-49760, hands attackers a quiet route to credential theft and privilege escalation, the kind that ends in Active Directory compromise. SafeBreach Labs uncovered it, and what makes it stand out is the combination: an attacker can impersonate core system services, and they can do it without admin rights.

I spend a lot of time looking at privilege-escalation primitives, and the ones that worry me most aren't the loud memory-corruption bugs. They're the logic gaps like this, where the operating system trusts a registration it never should have.

What EPM Poisoning Actually Is

Windows RPC leans on the Endpoint Mapper (EPM) to translate service IDs (UUIDs) into the running service endpoints behind them. EPM's registration process validates loosely, and that opens a race condition: an unprivileged process can "win" and register a UUID before the legitimate, privileged service even starts. Once it wins, every bit of RPC traffic meant for that service gets rerouted to the attacker's process. If you know DNS poisoning, the mental model is the same, with users silently redirected to a malicious server.

How the Attack Chain Works

1. Scheduled Execution: The attacker sets up an automated task to run an exploit tool (like SafeBreach's RPC-Racer) at login or system boot.
2. Preemptive Registration: Before delayed-start services (such as Storage Service) launch, the tool registers the attacker's own RPC endpoint under the service's UUID.
3. Hijacking and Redirection: When privileged services (for example, Delivery Optimization) query EPM, they get pointed at the attacker's fake service.
4. Credential Theft: The fake service hands back a crafted path (such as an SMB share). When the privileged service tries to authenticate to it, it leaks machine account NTLM hashes.
5. Active Directory Compromise: Via NTLM relay (the ESC8 attack), those credentials let the attacker request certificates and eventually pull Kerberos TGTs, which opens the path to full domain controller access.

That last step is what turns a local annoyance into a domain-wide problem. It's the same relay-to-certificate-to-TGT path I walk through in our Kerberoasting and AD mines breakdown, and it shows up again and again once an attacker lands a single machine account hash.

Beyond the Demo: Other Ways to Abuse It

• Man-in-the-Middle for RPC: Intercept and alter sensitive traffic between trusted Windows services.
• Privilege Escalation via File Operations: Pose as privileged file-service RPC endpoints to tamper with protected files.
• Service Impersonation: Steal credentials by impersonating components like the Vault Service or Account Sign-In Assistant.
• Lateral Movement: Use the hijacked credentials to pivot across hosts in the domain.

Why Is This Even Possible?

EPM accepts the first registration for any given UUID, no questions asked about whether the process is legitimate. Windows' use of delayed-start services makes it worse, handing attackers a reliable window to grab vital RPC endpoints on every single boot.

Mitigation Steps

Microsoft shipped a patch for CVE-2025-49760 on July 8, 2025. To shut the risk down:

• Apply the latest security updates to every affected Windows system (Windows 10, 11, Server 2016, 2022, 2025).
• Enforce NTLM relay protections by enabling SMB signing and LDAP channel binding.
• Shrink the attack surface by disabling unnecessary RPC services and auditing delayed-start settings.
• Restrict EPM access with RPC security policies so only trusted processes register.
• Monitor endpoint registrations and NTLM authentication for anything suspicious.

Where Deception Helps

Patching closes this specific bug, but the underlying goal, stealing a machine account hash and relaying it toward the domain, never goes away. That's where deception earns its place. Plant decoy NTLM credentials and honey service accounts in the environment, and an attacker chasing hashes trips an alarm the instant they bite. There's no signature to evade and no patch to wait on. The same idea drives our work on service account lateral movement and credential mines, and it pairs naturally with hardening the PAM and credential layer attackers go after next.

Security Takeaway

EPM Poisoning carries a low CVSS score (3.5), but don't let that lull you. The real-world impact on enterprise environments is high, especially anywhere Active Directory Certificate Services is in play. It's stealthy, it abuses boot-time race conditions, and it chains cleanly to full domain compromise. Patch it, monitor for it, and add a tripwire the attacker can't see. See how MINE2's credential mines catch this kind of theft before it reaches your domain controllers.

References:

• SafeBreach Labs: You Snooze, You Lose: Winning RPC Endpoints
• Microsoft Security Update Guide: CVE-2025-49760