Microsoft Windows up to Server 2025 SMB Client access control

Summaryinfo

A vulnerability classified as very critical was found in Microsoft Windows. This affects an unknown part of the component SMB Client. Executing a manipulation can lead to access control. This vulnerability is tracked as CVE-2025-33073. The attack can be launched remotely. Moreover, an exploit is present. A patch should be applied to remediate this issue.

Detailsinfo

A vulnerability has been found in Microsoft Windows and classified as very critical. This vulnerability affects an unknown function of the component SMB Client. The manipulation with an unknown input leads to a access control vulnerability. The CWE definition for the vulnerability is CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Improper access control in Windows SMB allows an authorized attacker to elevate privileges over a network.

The weakness was disclosed 06/10/2025 as confirmed security update guide (Website). The advisory is available at msrc.microsoft.com. This vulnerability was named CVE-2025-33073. The exploitation appears to be easy. The attack can be initiated remotely. Technical details are unknown but a public exploit is available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 10/20/2025). This vulnerability is assigned to T1068 by the MITRE ATT&CK project.

It is possible to download the exploit at exploit-db.com. It is declared as attacked. The vulnerability scanner Nessus provides a plugin with the ID 238094 (KB5061072: Windows Server 2008 Security Update (June 2025)), which helps to determine the existence of the flaw in a target environment. This issue was added on 10/20/2025 to the CISA Known Exploited Vulnerabilities Catalog with a due date of 11/10/2025:

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Applying a patch is able to eliminate this problem. A possible mitigation has been published immediately after the disclosure of the vulnerability.

The vulnerability is also documented in the databases at Exploit-DB (52330), Tenable (238094) and EUVD (EUVD-2025-17737). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Operating System

Vendor

• Microsoft

Name

• Windows

Version

• 10
• 10 21H2
• 10 22H2
• 10 1607
• 10 1809
• 11 22H2
• 11 23H2
• 11 24H2
• Server 2008 R2 SP1
• Server 2008 SP2
• Server 2012
• Server 2012 R2
• Server 2016
• Server 2019
• Server 2022
• Server 2022 23H2
• Server 2025

License

• commercial

Website

• Vendor: https://www.microsoft.com/
• Product: https://www.microsoft.com/en-us/windows

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion