CVE-2025-24054

CVE-2025-24054 is a spoofing vulnerability in Microsoft Windows NTLM caused by external control of a file name or path (CWE-73): when Windows processes a file whose name or path points to an attacker-controlled resource, the system is induced to authenticate via NTLM to that destination, disclosing the user's NTLM hash. An unauthorized network attacker triggers the flaw by convincing a user to interact with a crafted file, for example downloading or opening a malicious file, which sends NTLM credentials to a host of the attacker's choosing. With the captured NTLM hash, the attacker can attempt relay or offline cracking to spoof and impersonate the user on the network; no privileges are required, but user interaction is needed (CVSS 3.1: 5.4, medium). Any unpatched Windows 10 (1507 through 22H2), Windows 11 (22H2 through 24H2), or Windows Server 2008, 2012, 2016, or 2019 system in environments that use NTLM authentication is affected. The flaw is being actively exploited: CISA added it to the KEV catalog on 2025-04-17, EPSS puts the 30-day exploitation probability at about 59% (99th percentile), public proof-of-concept exploits exist, and multiple attack campaigns have been reported, including targeting of organizations in Poland and Romania shortly after the patch became available.

What to do: Apply Microsoft's April 2025 security updates across all listed Windows 10, Windows 11, and Windows Server releases and confirm updated builds through patch-management reporting; the flaw was added to CISA's KEV on 2025-04-17, so federal agencies must patch per BOD 22-01 deadlines or apply vendor mitigations. As interim mitigation, restrict outbound NTLM authentication (for example by blocking outbound TCP 445/139 to untrusted hosts, enforcing SMB signing, or removing NTLM where feasible) and hunt for anomalous outbound NTLM authentication following user file downloads or opening of untrusted shortcut files.