CVE-2025-50154

CVE-2025-50154 is an information-disclosure flaw (CWE-200) in Windows File Explorer that, per Microsoft's August 2025 advisory, allows an unauthenticated attacker on the network to expose sensitive information and perform spoofing. Public proof-of-concept write-ups characterize it as a zero-click issue in File Explorer, meaning the flaw can be triggered when the victim merely handles or views attacker-supplied content (e.g., browsing or opening a malicious file or folder), consistent with Microsoft's CVSS vector requiring only user interaction (UI:R) with no privileges or special conditions (AV:N/AC:L/PR:N). A successful attacker gains access to sensitive authentication-related information (confidentiality impact rated High), which can then be reused to impersonate or spoof the victim in network authentication; integrity and availability are not affected (CVSS 3.1: 6.5 Medium). Everyone running the listed Windows 10 and Windows 11 client versions and Windows Server 2008, 2012, 2016, or 2019 is affected, particularly workstations and servers where users browse untrusted file locations. The flaw is not yet on CISA's KEV list, but public PoCs/detection guidance exist and EPSS estimates a 25.6% probability of exploitation within 30 days (98th percentile), indicating elevated exploitation risk.

What to do: Apply Microsoft's August 2025 security updates for all listed Windows 10, Windows 11, and Windows Server versions. As an interim mitigation, block or restrict outbound SMB authentication from user workstations (e.g., TCP 445 egress to untrusted networks) and monitor for unexpected Kerberos/NTLM authentication attempts originating from File Explorer activity. Review the referenced public detection and mitigation scripts and hunt for signs of zero-click credential exposure in user environments.