Loading story…
A critical vulnerability in the Windows SMB client, tracked as CVE-2025-33073, is being actively exploited by threat actors months after Microsoft released a patch. The flaw, which affects Windows 10, Windows 11 (up to version 24H2), and all supported versions of Windows Server, was initially addressed in Microsoft's June 2025 Patch Tuesday update. The vulnerability allows attackers to escalate privileges to SYSTEM level by coercing a victim machine to connect to a malicious SMB server, where the protocol can be compromised. Attackers can exploit this by executing a specially crafted script or convincing users to run such a script, leading to authentication with the attacker's server and subsequent compromise. Security researchers from organizations including CrowdStrike, Synacktiv, GuidePoint Security, BNP Paribas, SySS GmbH, RedTeam Pentesting GmbH, and Google Project Zero contributed to the discovery and public disclosure of the flaw. Some researchers have highlighted that the vulnerability bypasses NTLM reflection mitigations and can be used for authenticated remote command execution, not just privilege escalation as initially described by Microsoft. Technical details and proof-of-concept exploits have been published, increasing the risk of widespread exploitation. The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025-33073 to its Known Exploited Vulnerabilities (KEV) catalog on October 20, 2025, confirming active exploitation in the wild. CISA has mandated that all US federal civilian agencies apply the patch or remove vulnerable systems from operation by November 10, 2025, under Binding Operational Directive 22-01. While this directive is specific to federal agencies, CISA has strongly urged all organizations to remediate the vulnerability immediately due to the ongoing attacks. The vulnerability was publicly disclosed at the time of patch release, but exploitation was not observed until months later, underscoring the importance of timely patch management. Microsoft has not yet issued a public statement regarding the active exploitation. The flaw's ability to bypass existing mitigations and enable remote command execution makes it particularly dangerous for enterprise environments. Organizations that have not yet applied the June 2025 patch remain at significant risk of compromise. The ongoing exploitation highlights the persistent threat posed by delayed patching and the rapid weaponization of disclosed vulnerabilities. Security teams are advised to prioritize remediation and monitor for signs of exploitation related to CVE-2025-33073.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
CISA warned on October 21, 2025 that CVE-2025-33073 was under active exploitation and added the Windows SMB flaw to its Known Exploited Vulnerabilities catalog. The agency ordered U.S. federal civilian agencies to remediate the issue within 21 days and urged broader rapid patching.
Researchers from Synacktiv reported that CVE-2025-33073 enables an NTLM reflection-style attack that bypasses prior Microsoft mitigations. Their analysis said the technique abuses crafted DNS resolution and can fail where SMB signing is enforced.
Microsoft released a fix for CVE-2025-33073 in June 2025. The Windows SMB client-side improper access control flaw was rated CVSS 8.8 and could be exploited to obtain SYSTEM privileges by coercing a victim to authenticate to an attacker-controlled server.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
go.theregister.com
Open sourcehelpnetsecurity.com
Open sourcebankinfosecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft has disclosed a critical elevation-of-privilege vulnerability in the Windows Kernel, tracked as CVE-2025-62215, which is being actively exploited in the wild. The flaw arises from a race condition and improper memory management, specifically a double-free scenario, allowing local attackers to escalate privileges to SYSTEM level. Exploitation requires an attacker to already have access to the system, but no user interaction is needed, and the attack can be automated. Microsoft has rated the vulnerability as Important, with a CVSS score of 7.0, and notes that all supported Windows 10 editions are affected, including those under Extended Security Updates (ESU). No workaround is available other than applying the official update, and immediate patching is strongly recommended. The vulnerability is classified under CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization) and CWE-415 (Double Free), making it a classic post-compromise privilege escalation vector. Attackers can exploit the timing-sensitive memory corruption path in the kernel to gain elevated access, disable security defenses, and move laterally within networks. The attack surface is particularly concerning in enterprise environments where multiple users share access, as any authenticated user can potentially trigger the exploit. Security experts warn that both targeted threat actors and ransomware operators may leverage this flaw to deepen their foothold after initial access, emphasizing the urgency of deploying the security update across all affected systems.
Jul 12, 2026
Microsoft released an urgent out-of-band security update to address a critical remote code execution vulnerability in Windows Server Update Services (WSUS), identified as CVE-2025-59287. The flaw was reportedly under active exploitation in the wild, prompting Microsoft to issue a comprehensive fix outside of its regular update cycle. Security advisories and industry news highlighted the severity of the vulnerability and its inclusion in the U.S. CISA Known Exploited Vulnerabilities catalog, underscoring the immediate risk to organizations relying on WSUS for patch management. The vulnerability allowed attackers to potentially execute arbitrary code on affected WSUS servers, posing a significant threat to enterprise environments. Security experts urged organizations to apply the patch without delay to mitigate the risk of compromise. The rapid response from Microsoft and the attention from security agencies reflect the critical nature of the flaw and the ongoing threat landscape targeting core infrastructure components like WSUS.
Jul 12, 2026
Microsoft released fixes for 61 vulnerabilities in its May security updates, including three zero-days and one critical flaw, with **CVE-2024-30040** and **CVE-2024-30051** confirmed as actively exploited in the wild. The patched issues affect core Microsoft products including Windows, Office, SharePoint, .NET, Visual Studio, and Windows Server, and include a **Windows MSHTML Platform security feature bypass** and a **Windows DWM Core Library elevation-of-privilege flaw** that can allow attackers to gain `SYSTEM` privileges. Researchers who reported **CVE-2024-30051** said they validated the Windows Desktop Window Manager flaw after finding a suspicious document uploaded to VirusTotal, then later observed an exploit in mid-April being used with **QakBot** and other malware. Kaspersky assessed that multiple threat actors likely had access to the exploit before the patch was released, underscoring the urgency for organizations to deploy Microsoft's updates immediately across affected Windows and server environments.
Jul 24, 2026