CVE-2025-24071

CVE-2025-24071 is an information-exposure/spoofing flaw (CWE-200) in Windows File Explorer in which Explorer can be induced to send the user's sensitive authentication material - an NTLM credential hash, per the related Windows NTLM reporting - to an attacker-controlled resource over the network. Because the attack vector is network-based but requires user interaction (CVSS AV:N/UI:R, no privileges needed), a typical attack lures a user into viewing or opening a crafted file or remote location in File Explorer, at which point Windows automatically authenticates to the attacker's endpoint. The attacker gains high-value confidential data - the user's credential hash - which can be cracked offline or relayed to spoof/impersonate the user, with no direct integrity or availability impact. Essentially every unpatched Windows deployment is exposed: Windows 10 (1507, 1607, 1809), Windows 11 (23H2, 24H2), and Windows Server 2012 through 2025 all ship File Explorer. The flaw is not yet in CISA KEV and has one public PoC/detection reference, but the sibling Windows NTLM flaw CVE-2025-24054 has already been exploited in the wild in campaigns (including targets in Poland and Romania days after patching) attributed to EncryptHub, and this CVE's EPSS of 24.6% (98th percentile) signals elevated near-term exploitation risk.

What to do: Apply Microsoft's latest cumulative Windows security updates on all affected Windows 10, Windows 11, and Windows Server hosts - Microsoft fixed this flaw in its March 2025 Patch Tuesday releases - prioritizing servers and user-facing workstations that handle untrusted files. Until patched, block outbound SMB/NTLM to untrusted hosts (e.g., via Windows Defender Firewall) to blunt hash-leak/spoofing attempts and avoid opening or previewing untrusted files and remote locations in File Explorer. Given that the closely related NTLM flaw CVE-2025-24054 was exploited in the wild by the actor Microsoft attributes to EncryptHub soon after patching, monitor for abnormal outbound NTLM/SMB connections and treat this CVE as a likely near-term target.