CVE-2021-28325

What it actually does

CVE-2021-28325 is a Windows SMB information disclosure vulnerability affecting multiple Windows client and server versions. The flaw can be reached over the network through SMB and requires the attacker to have low-privileged access, but it does not require user interaction. Successful exploitation can disclose sensitive information from the targeted system or SMB service context. The CVSS vector indicates high confidentiality impact with no direct integrity or availability impact.

Why it matters to the business

An attacker with basic access to a Windows network may be able to retrieve sensitive information from affected Windows systems, potentially exposing credentials, system details, file-sharing metadata, or other data useful for deeper compromise. While this vulnerability is not listed in CISA KEV and has no known ransomware association in the provided data, its EPSS score is relatively high, meaning exploitation is considered plausible and should be prioritized on Windows servers and workstations where SMB is reachable.

How an attack unfolds

An attacker first obtains low-privileged access to a network where SMB is exposed, such as through a compromised domain account, VPN access, or another foothold. The attacker then connects to an affected Windows SMB service and sends crafted SMB requests that trigger the information disclosure condition. If successful, the attacker receives sensitive data not normally available to that privilege level. The disclosed information may then be used to map the environment, identify valuable shares or hosts, support credential theft, bypass protections, or prepare follow-on attacks. Because exploitation is network-accessible and requires no user interaction, exposed SMB services on internal networks are the primary concern.

How to fix it

Apply the Microsoft security updates released for the affected Windows versions, including Windows 10, Windows 8.1, Windows RT 8.1, Windows Server 2012, Windows Server 2016, and Windows Server 2019. No exact fixed build numbers were provided in the input, so remediation should be validated against Microsoft’s official security update guidance for CVE-2021-28325 and the April 2021 security update baseline. As compensating controls, restrict SMB access to trusted networks only, block inbound SMB from untrusted segments and the internet, disable SMBv1 if still enabled, enforce least-privilege access to file shares, and monitor authenticated SMB activity for unusual enumeration or probing.

How to confirm the fix worked

Confirm that all affected Windows systems have the relevant Microsoft security update installed by checking Windows Update compliance, enterprise patch management records, or installed hotfix/build information. Validate that SMB is not exposed to untrusted networks by scanning for TCP/445 and reviewing firewall rules. Test representative systems to confirm they are on patched OS builds and that unsupported Windows versions have been retired, isolated, or otherwise protected. Review SMB hardening settings, including SMBv1 status, network segmentation, and allowed administrative access paths.

Typical attack path

1. Gain low-privileged access to a Windows network or authenticated SMB-capable context.
2. Identify Windows hosts exposing SMB, typically TCP port 445.
3. Probe target systems to determine operating system and SMB service behavior.
4. Send crafted SMB requests to an affected Windows SMB implementation.
5. Capture information disclosed by the vulnerable SMB service.
6. Use the disclosed data to support lateral movement, privilege escalation, credential targeting, or further reconnaissance.

How to detect it

To determine whether this vulnerability may have been exploited, review Windows and network logs for suspicious authenticated SMB activity around affected systems. Relevant sources include Windows Security logs, SMB Server operational logs, firewall logs, endpoint detection telemetry, NetFlow, and packet captures where available. Look for unusual connections to TCP/445, repeated SMB session setup attempts, abnormal share enumeration, access from unexpected workstations, service accounts performing interactive-style SMB access, and bursts of tree connect or file query operations. Because the vulnerability is an information disclosure issue, exploitation may not leave a unique error message or file artifact; detection should focus on anomalous SMB behavior, suspicious authenticated access patterns, and follow-on activity such as lateral movement, credential dumping, or reconnaissance commands after SMB access. No public threat actor or ransomware campaign association was provided, and the vulnerability is not listed as KEV in the supplied data.

• TCP/445
• Microsoft-Windows-SMBServer/Operational
• Event ID 5140
• Event ID 5145
• Event ID 4624 Logon Type 3
• Event ID 4672
• Event ID 7045
• ADMIN$
• C$
• IPC$
• \\*\IPC$
• net view
• net use
• nltest /dclist
• whoami /priv

What your security team should do

• Prioritize patching Windows servers and high-value workstations that expose SMB internally or across network boundaries.
• Use vulnerability scanning and patch compliance tooling to identify Windows 10, Windows 8.1, Windows RT 8.1, Windows Server 2012, Windows Server 2016, and Windows Server 2019 systems missing the relevant Microsoft security update.
• Block SMB traffic from the internet and restrict TCP/445 between network segments to only required systems.
• Disable SMBv1 and enforce modern SMB security controls wherever possible.
• Review file share and SMB permissions to reduce the value of any disclosed information.
• Monitor for unusual authenticated SMB reconnaissance, excessive share enumeration, and connections from unexpected hosts.
• Treat exploitation attempts as potential precursor activity for lateral movement or credential theft, even though the vulnerability itself is information disclosure only.