CVE-2025-33053

What it actually does

This is a remote code execution vulnerability in Microsoft Windows handling of Internet Shortcut files (.url). A crafted shortcut can externally control a file name or path so that, when Windows processes the shortcut, execution is redirected to attacker-controlled content over a network location such as SMB or WebDAV. Successful exploitation allows code to run in the context of the user who opened or triggered processing of the shortcut, which can lead to malware execution, credential theft, persistence, lateral movement, or privilege escalation through follow-on techniques.

Why it matters to the business

Because this flaw is known to be exploited in the wild, has a high EPSS likelihood of exploitation, and is listed in CISA KEV with a remediation deadline of 2025-07-01, it should be treated as an urgent Windows endpoint and server exposure. A successful attack can turn a seemingly harmless shortcut file into a malware launch point, enabling compromise of employee workstations, disruption of business operations, theft of sensitive data, and footholds for broader network intrusion. The high exploit probability means organizations should assume phishing, file-share, and drive-by delivery attempts are likely across Windows fleets that are not current on security updates.

How an attack unfolds

An attacker prepares a malicious Internet Shortcut file that contains a controlled path or filename pointing to attacker-hosted content on a remote network resource. The file is delivered through common initial-access channels such as phishing attachments, compressed archives, downloaded files, collaboration platforms, or writable network shares. When a user opens the shortcut, extracts it, or otherwise causes Windows shell components to process it, Windows resolves the attacker-controlled path and can execute code from the remote location. The payload then runs with the victim user's privileges and may establish persistence, contact command-and-control infrastructure, download additional tooling, steal credentials or browser data, and attempt lateral movement using available domain, VPN, or cached credentials. Public reporting indicates active exploitation in the wild, so defenders should prioritize both patching and retrospective hunting for suspicious .url handling and network-launched processes.

How to fix it

Apply the Microsoft security updates that address CVE-2025-33053 across all supported Windows systems; for most organizations this means deploying the June 2025 cumulative security updates or later. Prioritize internet-facing systems, endpoints used for email and web browsing, jump hosts, administrator workstations, and file servers where users may interact with shortcut files. Where patching cannot be completed immediately, reduce exposure by blocking or quarantining Internet Shortcut files from untrusted sources, disabling or restricting WebDAV/WebClient where not required, blocking outbound SMB to the internet, limiting execution from remote shares, enforcing Attack Surface Reduction rules, and ensuring endpoint protection inspects archives and downloaded shortcut files. Treat the CISA KEV deadline of 2025-07-01 as the latest acceptable remediation date for covered organizations and a strong urgency signal for all others.

How to confirm the fix worked

Confirm that affected Windows systems have the Microsoft security update level from June 2025 or later installed, using Windows Update, WSUS, Intune, SCCM, vulnerability scanners, or endpoint inventory. Validate that unsupported Windows versions are either upgraded, isolated, or otherwise protected. Test controls by ensuring email, web proxy, EDR, and file security policies detect or block suspicious .url files that reference UNC, SMB, or WebDAV paths. Confirm outbound SMB to the internet is blocked at network egress points unless explicitly required. Review endpoint telemetry for recent execution chains where explorer.exe or an email/archive/browser process handled a .url file and then launched script interpreters, LOLBins, or binaries from network paths.

Typical attack path

1. Attacker crafts a malicious .url Internet Shortcut file with an externally controlled path to a network-hosted payload.
2. Attacker delivers the shortcut through phishing, a ZIP/archive, a web download, a collaboration platform, or a shared folder.
3. Victim opens or otherwise triggers Windows processing of the shortcut file.
4. Windows resolves the attacker-controlled SMB/WebDAV/UNC path referenced by the shortcut.
5. Attacker-controlled code executes over the network in the context of the logged-on user.
6. Payload establishes persistence, contacts command-and-control infrastructure, stages additional malware, steals credentials, or moves laterally.

How to detect it

Perform retrospective hunting across endpoint, email, proxy, DNS, firewall, and file-share telemetry for suspicious handling of Internet Shortcut files. Key log sources include Windows Security Event ID 4688 process creation, Sysmon Event ID 1 process creation, Sysmon Event ID 3 network connections, Sysmon Event ID 11 file creation, PowerShell Operational logs, Microsoft Defender for Endpoint process and file events, EDR file reputation events, email gateway attachment logs, web proxy downloads, SMB/WebDAV egress logs, and file server access logs. Look for .url files received from external email, downloaded from the web, extracted from archives, or created in user-writable locations shortly before execution of cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe, regsvr32.exe, or binaries from UNC/WebDAV paths. Inspect shortcut contents for remote path values in URL, IconFile, or WorkingDirectory fields. Investigate outbound connections to unfamiliar SMB/WebDAV destinations, especially paths using DavWWWRoot or UNC references. On endpoints, collect the malicious .url file if present, Zone.Identifier alternate data streams, browser download history, email artifacts, archive extraction traces, Prefetch, Amcache/Shimcache, SRUM, ShellBags, Jump Lists, and EDR process trees to determine whether code execution occurred and what follow-on payloads were launched.

• .url
• [InternetShortcut]
• URL=\\
• URL=file://
• URL=http://
• URL=https://
• WorkingDirectory=\\
• IconFile=\\
• DavWWWRoot
• \\@SSL\DavWWWRoot\
• Zone.Identifier
• explorer.exe -> cmd.exe
• explorer.exe -> powershell.exe
• explorer.exe -> wscript.exe
• explorer.exe -> cscript.exe
• explorer.exe -> mshta.exe
• explorer.exe -> rundll32.exe
• explorer.exe -> regsvr32.exe
• outlook.exe -> explorer.exe
• winword.exe -> explorer.exe
• chrome.exe -> explorer.exe
• msedge.exe -> explorer.exe
• firefox.exe -> explorer.exe
• 7zFM.exe -> explorer.exe
• winrar.exe -> explorer.exe
• WebClient
• Microsoft-Windows-WebClnt/Operational
• \\*\*.exe
• file://*/DavWWWRoot/

What your security team should do

• Immediately identify Windows assets missing the June 2025 or later security update and prioritize remediation based on user exposure, privilege level, and network access.
• Deploy or verify email, web, and EDR rules that flag Internet Shortcut files containing remote UNC, SMB, or WebDAV paths.
• Block outbound SMB to the internet and restrict WebDAV/WebClient usage where operationally feasible.
• Hunt retrospectively for suspicious .url files, network-hosted payload execution, and process trees spawned by explorer.exe, Outlook, browsers, archive utilities, or collaboration clients.
• Increase monitoring for post-exploitation behaviors such as credential dumping, persistence creation, PowerShell abuse, rundll32/regsvr32/mshta execution, and unusual outbound connections.
• Educate help desk and users to report unexpected shortcut files, especially those received in archives or from external senders.
• For systems that cannot be patched quickly, isolate them, remove unnecessary user interaction paths, and apply application control to prevent execution from remote locations.