CVE-2025-21377

CVE-2025-21377 is an NTLM hash disclosure (spoofing) vulnerability in Microsoft Windows, tracked as CWE-73 (external control of file name or path). An attacker who can get a user to interact with attacker-influenced content, such as a crafted file or path reference, can cause Windows to authenticate or respond in a way that leaks the user's NTLM hash to an endpoint the attacker controls, consistent with the CVSS vector's network vector and required user interaction. The attacker gains the user's NTLM hash, which can be cracked offline or replayed to authenticate as (spoof) that user; the flaw affects confidentiality only, with no direct integrity or availability impact. Any user or server running the affected Windows releases is exposed, with the risk highest where users handle untrusted files or where NTLM authentication is permitted. As of the February 2025 Patch Tuesday coverage, this flaw is not reported as actively exploited and is not on the CISA KEV, with no public proof-of-concept known, though its high EPSS percentile (98th, ~24.5% chance of exploitation within 30 days) indicates elevated exploitation risk.

What to do: Apply the February 2025 (or later) Windows security updates from Windows Update or the Microsoft Update Catalog on all affected Windows 10/11 clients and Windows Server 2008/2012/2016/2019 hosts. As interim hardening, restrict outbound NTLM authentication where feasible (e.g., limiting NTLM via group policy or blocking legacy NTLM traffic), since the flaw leaks NTLM hashes that can be cracked or replayed. Because this is not yet in CISA KEV and no public PoC is known, it can be prioritized within normal patch cycles, but the high EPSS score argues for patching internet-facing and file-handling systems first.