CVE-2025-33073

What it actually does

CVE-2025-33073 is an improper access-control flaw in Windows SMB that allows an authenticated attacker to elevate privileges over the network. The issue affects how SMB-related authentication and authorization context is handled, enabling an attacker who can cause or intercept SMB/NTLM authentication to gain higher-privileged access than intended. Successful exploitation can result in privilege escalation on Windows systems or in the surrounding Windows authentication environment, particularly where NTLM relay, SMB coercion, or outbound SMB to untrusted hosts is possible.

Why it matters to the business

This vulnerability can turn ordinary domain or local access into privileged access, increasing the risk of lateral movement, domain compromise, data theft, and service disruption. Because it is listed in CISA KEV, has active in-the-wild exploitation, and has a high EPSS score, organizations should treat it as an urgent enterprise Windows remediation item. The CISA remediation deadline is 2025-11-10 for covered organizations, but exposed or high-value Windows environments should be remediated sooner.

How an attack unfolds

An attacker first obtains a foothold or valid low-privileged access in a Windows environment, or positions infrastructure where Windows hosts can be induced to authenticate over SMB. The attacker then triggers or coerces an SMB/NTLM authentication attempt to an attacker-controlled or relay-capable endpoint. Due to improper access control in Windows SMB handling, the attacker can abuse the resulting network authentication context to elevate privileges or relay access to more sensitive services. In observed exploitation patterns associated with NTLM relay and hash-leakage campaigns, attackers may combine this flaw with coercion techniques, outbound SMB exposure, weak NTLM restrictions, and insufficient SMB signing or relay protections. Once elevated, the attacker can create privileged sessions, access administrative shares, dump credentials, deploy tooling, disable defenses, or move laterally to additional Windows systems.

How to fix it

Apply the Microsoft security updates that address CVE-2025-33073 across all supported Windows systems, prioritizing domain controllers, file servers, jump hosts, administrative workstations, and systems with broad network reachability. If exact package-level fixed versions are not available in the input, use the vendor security update guidance for the June 2025 Windows security release or later cumulative updates. Reduce exploitability by disabling or restricting NTLM where feasible, enforcing SMB signing, blocking outbound SMB to the internet and untrusted networks, limiting inbound SMB to required management paths, hardening relay protections such as Extended Protection for Authentication where applicable, and removing unnecessary local administrator rights. Monitor for and remediate systems that cannot receive security updates by isolating SMB access, applying strict firewall controls, and increasing logging.

How to confirm the fix worked

Confirm that all supported Windows assets have the Microsoft update that remediates CVE-2025-33073 installed, typically through centralized patch reporting, endpoint inventory, or Windows Update compliance tooling. Validate that SMB traffic to untrusted networks is blocked, SMB signing policy is enforced where required, and NTLM usage is audited or restricted according to organizational policy. Test representative hosts to ensure they no longer expose the vulnerable behavior after patching. Review firewall policy for TCP/445 and TCP/139, confirm domain controllers and file servers are patched first, and verify that legacy systems unable to patch are segmented from untrusted SMB/NTLM paths.

Typical attack path

1. Gain a low-privileged foothold, valid credentials, or network position capable of interacting with Windows SMB/NTLM authentication.
2. Identify Windows hosts that can initiate outbound SMB connections or accept relayed NTLM authentication.
3. Coerce or entice a target system or user session to authenticate to an attacker-controlled SMB endpoint.
4. Capture or relay SMB/NTLM authentication material during the network authentication flow.
5. Abuse the SMB improper access-control condition to obtain elevated privileges or privileged network access.
6. Use elevated access to access administrative shares, execute remote commands, dump credentials, or modify system configuration.
7. Move laterally to additional Windows systems and attempt persistence or broader domain compromise.

How to detect it

To determine whether exploitation has already occurred, review Windows Security logs, SMB client/server logs, NTLM operational logs, domain controller authentication logs, EDR telemetry, firewall records, and network flow data. Focus on outbound SMB connections from workstations or servers to unusual internal hosts, internet IPs, or systems that should not receive Windows authentication. Look for NTLM authentication spikes, NTLM relay patterns, unexpected privileged logons shortly after SMB activity, administrative share access from unusual sources, remote service creation, scheduled task creation, process execution over SMB/RPC, and credential-access tooling. On domain controllers, review NTLM validation events and unusual account authentication paths. On endpoints, correlate SMB connections with processes that opened files from UNC paths or triggered network authentication. Because exploitation may not leave a unique CVE-specific marker, prioritize behavioral chains: coerced SMB authentication, NTLM relay or hash capture, followed by privilege escalation, lateral movement, or administrative action.

• Microsoft-Windows-SMBClient/Connectivity
• Microsoft-Windows-SMBClient/Security
• Microsoft-Windows-SMBServer/Operational
• Microsoft-Windows-NTLM/Operational
• Event ID 4624
• Event ID 4625
• Event ID 4648
• Event ID 4672
• Event ID 4776
• Event ID 7045
• Event ID 4697
• Event ID 4698
• LogonType=3
• AuthenticationPackageName=NTLM
• PackageName=NTLM V2
• TargetPort=445
• TargetPort=139
• \\ADMIN$
• \\C$
• \\IPC$
• Service Control Manager
• RemoteRegistry
• psexesvc
• PAExec
• wmic.exe
• sc.exe
• schtasks.exe
• net.exe use
• ntlmrelayx
• Responder
• Inveigh
• impacket-smbserver

What your security team should do

• Treat this as a high-priority active-exploitation Windows issue because it is in CISA KEV, has high EPSS, and is associated with NTLM relay/hash-leakage activity.
• Patch domain controllers, file servers, administrative workstations, and internet-adjacent or broadly reachable Windows systems first, then complete enterprise-wide Windows patching.
• Block outbound SMB traffic to the internet and untrusted networks at host firewalls, network firewalls, and proxy egress controls.
• Audit and reduce NTLM usage; disable NTLM where feasible and prioritize protections against NTLM relay.
• Enforce SMB signing and harden authentication services that accept relayed credentials, including applying Extended Protection for Authentication where supported.
• Hunt for recent anomalous SMB/NTLM authentication, especially outbound SMB to unknown hosts, repeated NTLM failures, or privileged logons following unusual SMB activity.
• Review privileged group membership, local administrator changes, remote service creation, scheduled task creation, and credential-dumping indicators on systems showing suspicious SMB authentication.
• For CISA-covered entities, complete remediation no later than 2025-11-10, with earlier remediation strongly recommended for high-risk Windows environments.