CVE-2025-33073KEV · OVERDUECWE-284

Windows SMB Client Elevation of Privilege Vulnerability

High · published June 10, 2025

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 99.7th percentile for exploit probability.

348
days past CISA
deadline
CVSS v3.1
8.8
EPSS
83%
Percentile
99.7
In the wild
Confirmed
What it is

⚡ A sneaky flaw in Windows SMB lets authorized attackers elevate their privileges over the network! 🦸‍♂️ Think of it like a restaurant where a waiter suddenly gains access to the kitchen, allowing them to whip up any dish they want — including a few that might spoil the customers’ experience! 🍽️ This vulnerability could lead to complete system compromise, allowing attackers to perform actions that should be restricted, like accessing sensitive data or even taking control of other user accounts. An attacker with this privilege could wreak absolute havoc, making it a critical issue that cannot be ignored! 🔥

Put simply

Think of it like a restaurant where a waiter suddenly gains access to the kitchen, allowing them to whip up any dish they want — including a few that might spoil the customers’ experience! 🍽️ CVE-2025-33073 stems from improper access control in Windows Server Message Block (SMB) protocol, enabling privilege escalation for users who are already authenticated on the network.

What to do

This vulnerability could lead to complete system compromise, allowing attackers to perform actions that should be restricted, like accessing sensitive data or even taking control of other user accounts. An attacker with this privilege could wreak absolute havoc, making it a critical issue that cannot be ignored! 🔥 Update your systems immediately to the latest security patch provided by Microsoft. Additionally, review your user permissions and ensure least privilege access is enforced to minimize potential exploitation. Regular audits of user roles can also bolster your defenses! You've got this! By following these steps, you’ll be well on your way to securing your network! 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.82699 · 99.7th percentile
Weakness
CWE-284 · Improper Access Control
Published
2025-06-10T17:02Z
KEV added
2025-10-20 · due 2025-11-10
EPSS history
Timeline
  • 20 OCT 00:00Z
    Added to CISA KEV — remediate by Nov 10
    kev
  • 10 JUN 17:02Z
    Windows SMB Client Elevation of Privilege Vulnerability
    cvelistv5