CVE-2025-64676 is a path traversal vulnerability (CWE-35) in Microsoft Purview. It allows an attacker with authorized access to execute arbitrary code remotely by exploiting improper validation of path inputs containing '.../...//' sequences. The vulnerability has a CVSS 3.1 base score of 7.2, indicating high severity with network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. Microsoft has released a patch to remediate this vulnerability.

Successful exploitation of this vulnerability enables an authorized attacker to execute arbitrary code remotely on the affected Microsoft Purview system, potentially leading to full compromise of confidentiality, integrity, and availability of the system. This could result in unauthorized data access, modification, or service disruption.

A patch is available for this vulnerability and should be applied promptly to affected Microsoft Purview installations. Since this is not a cloud service, administrators must manually update their deployments. There are no known exploits in the wild, but timely patching is recommended to prevent potential exploitation.