CVE-2025-33073

CVE-2025-33073 is an improper access control flaw (CWE-284) in the Windows SMB client that allows an authorized, low-privileged attacker to elevate privileges over the network (CVSS 3.1: 8.8). The attack is network-based with low attack complexity and no user interaction: the attacker must get a vulnerable Windows machine's SMB client to connect to their crafted SMB server, and crafted server responses during the client's authentication flow cause the client to grant the attacker elevated (reportedly SYSTEM-level) access. An attacker gains local privilege elevation on the connecting Windows client, which can be used for full host compromise and lateral movement. Affected systems include essentially all currently supported Windows desktop and server branches in the data: Windows 10 (1507, 1607, 1809, 21H2, 22H2), Windows 11 (22H2, 23H2, 24H2), and Windows Server 2008, 2012, 2016 and 2019. The flaw is actively exploited in the wild — CISA added it to the KEV catalog on 2025-10-20 (ransomware linkage unknown), and EPSS places it at an 80.5% probability of exploitation within 30 days (100th percentile).

What to do: Apply Microsoft's June 2025 (or later) cumulative security updates that address CVE-2025-33073 on all listed Windows 10, Windows 11, and Windows Server systems, prioritizing domain-critical, internet-reachable, and server assets given active exploitation. If immediate patching is not possible, restrict SMB client access to trusted servers and follow Microsoft guidance on hardening NTLM authentication; note that federal agencies must meet CISA KEV/BOD 22-01 remediation timelines following the 2025-10-20 KEV listing. Verify the update actually landed on each host (checking that CVE-2025-33073 is listed as addressed) and hunt for connections to untrusted SMB servers from Windows clients.