cbcvebase.
CVE-2025-33073
published 2025-06-10

CVE-2025-33073: Improper access control in Windows SMB allows an authorized attacker to elevate privileges over a network.

PriorityP197high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
KEVITWEXPLOITRansomware
CISA Known Exploited Vulnerabilitydue 2025-11-10
Exploited in the wild
EPSS
78.52%
99.5th percentile
Improper access control in Windows SMB allows an authorized attacker to elevate privileges over a network.

Affected

47 ranges· showing 25
VendorProductVersion rangeFixed in
microsoftwindows_10_1507< 10.0.10240.2103410.0.10240.21034
microsoftwindows_10_1607< 10.0.14393.814810.0.14393.8148
microsoftwindows_10_1809< 10.0.17763.743410.0.17763.7434
microsoftwindows_10_21h2< 10.0.19044.596510.0.19044.5965
microsoftwindows_10_22h2< 10.0.19045.596510.0.19045.5965
microsoftwindows_10_version_1507>= 10.0.10240.0 < 10.0.10240.2103410.0.10240.21034
microsoftwindows_10_version_1607>= 10.0.14393.0 < 10.0.14393.814810.0.14393.8148
microsoftwindows_10_version_1809>= 10.0.17763.0 < 10.0.17763.743410.0.17763.7434
microsoftwindows_10_version_21h2>= 10.0.19044.0 < 10.0.19044.596510.0.19044.5965
microsoftwindows_10_version_22h2>= 10.0.19045.0 < 10.0.19045.596510.0.19045.5965
microsoftwindows_11_22h2< 10.0.22621.547210.0.22621.5472
microsoftwindows_11_23h2< 10.0.22631.547210.0.22631.5472
microsoftwindows_11_24h2< 10.0.26100.427010.0.26100.4270
microsoftwindows_11_version_22h2>= 10.0.22621.0 < 10.0.22621.547210.0.22621.5472
microsoftwindows_11_version_22h3>= 10.0.22631.0 < 10.0.22631.547210.0.22631.5472
microsoftwindows_11_version_23h2>= 10.0.22631.0 < 10.0.22631.547210.0.22631.5472
microsoftwindows_11_version_24h2>= 10.0.26100.0 < 10.0.26100.434910.0.26100.4349
microsoftwindows_server_2008
microsoftwindows_server_2008_r2_service_pack_1>= 6.1.7601.0 < 6.1.7601.277696.1.7601.27769
microsoftwindows_server_2008_service_pack_2>= 6.0.6003.0 < 6.0.6003.233516.0.6003.23351
microsoftwindows_server_2012
microsoftwindows_server_2012>= 6.2.9200.0 < 6.2.9200.255226.2.9200.25522
microsoftwindows_server_2012_r2>= 6.3.9600.0 < 6.3.9600.226206.3.9600.22620
microsoftwindows_server_2016< 10.0.14393.814810.0.14393.8148
microsoftwindows_server_2016>= 10.0.14393.0 < 10.0.14393.814810.0.14393.8148

Detection & IOCsextracted from sources · hover to see the quote

otherlocalhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA
path%SYSTEMROOT%\Temp\__output
filenameexecute.bat
command%COMSPEC% /Q /c echo whoami ^> %SYSTEMROOT%\Temp\__output > %TEMP%\execute.bat & %COMSPEC% /Q /c %TEMP%\execute.bat & del %TEMP%\execute.bat
otherIPC$
  • Alert on NTLMSSP authentication traffic over SMB where the negotiated hostname matches a manipulated/crafted value resembling the local machine name — indicative of NTLM reflection/local relay exploitation of CVE-2025-33073.
  • Alert on execution of batch files from %TEMP% that run 'whoami' and redirect output to %SYSTEMROOT%\Temp\__output — a post-exploitation privilege-check pattern observed after CVE-2025-33073 exploitation.
  • Monitor for IPC$ share access combined with NTLMSSP negotiation where the source and destination resolve to the same host — characteristic of NTLM reflection attacks exploiting CVE-2025-33073.
  • Create SIEM alerts for scheduled tasks matching the string 'gentlemen*', as The Gentlemen ransomware group (active exploiter of CVE-2025-33073) uses this naming pattern.
  • Enforce SMB signing and disable SMBv1 to mitigate the self-propagation mechanism leveraged via CVE-2025-33073 lateral movement.
  • Monitor for wevtutil usage to clear Security/System logs as a defense evasion step following CVE-2025-33073 exploitation.
  • Monitor for vssadmin and wmic commands deleting Volume Shadow Copies as a post-exploitation impact step in campaigns exploiting CVE-2025-33073.
  • Monitor for Kerberos relay attacks and SMB authentication anomalies following lateral movement from Linux hosts, as CVE-2025-33073 was chained in a multi-stage intrusion involving F5 BIG-IP and Confluence pivoting.

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vulncheck8.8HIGH
cisa8.8HIGH
vendor_msrc8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.