CVE-2025-33073
Microsoft Windows SMB Client Improper Access Control Vulnerability
Description
CVE-2025-33073 is a high-severity improper access control vulnerability in Windows SMB that allows an authorized attacker to elevate privileges over a network. With a CVSS v3.1 base score of 8.8 and an EPSS score of 51.2% (97.8th percentile), this vulnerability poses a significant threat to organizations using Windows client and server systems. CISA has added CVE-2025-33073 to the Known Exploited Vulnerabilities catalog with a remediation deadline of November 10, 2025, confirming active exploitation. The vulnerability affects a broad range of Windows versions from Windows 10 1507 through Windows 11 24H2.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | < 10.0.10240.21034 |
| microsoft | windows 10 1607 | < 10.0.14393.8148 |
| microsoft | windows 10 1809 | < 10.0.17763.7434 |
| microsoft | windows 10 21h2 | < 10.0.19044.5965 |
| microsoft | windows 10 22h2 | < 10.0.19045.5965 |
| microsoft | windows 11 22h2 | < 10.0.22621.5472 |
| microsoft | windows 11 23h2 | < 10.0.22631.5472 |
| microsoft | windows 11 24h2 | < 10.0.26100.4270 |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | < 10.0.14393.8148 |
| microsoft | windows server 2019 | < 10.0.17763.7434 |
| microsoft | windows server 2022 | < 10.0.20348.3745 |
| microsoft | windows server 2022 23h2 | < 10.0.25398.1665 |
| microsoft | windows server 2025 | < 10.0.26100.4270 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-33073(Vendor Advisory)
- https://www.vicarius.io/vsociety/posts/cve-2025-33073-detection-script-improper-access-control-in-windows-smb-affects-microsoft-products(Third Party Advisory)
- https://www.vicarius.io/vsociety/posts/cve-2025-33073-mitigation-script-improper-access-control-in-windows-smb-affects-microsoft-products(Mitigation, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-33073(US Government Resource)
Weakness Type
CWE-284: Improper Access Control
CWE-284 describes a general weakness where software fails to properly restrict access to resources or functionality, allowing actors to perform actions or access data beyond their intended authorization level. In CVE-2025-33073, the Windows SMB implementation does not enforce access controls correctly, enabling an authenticated low-privilege user to escalate their privileges over the network. Improper access control in SMB is particularly dangerous given SMB's ubiquitous use in Windows enterprise environments for file sharing and inter-process communication.
Impact Analysis
The business impact of CVE-2025-33073 is substantial across all three security dimensions. Confidentiality impact is high because privilege escalation through SMB could give an attacker access to restricted file shares, administrative data, and sensitive resources that are normally protected by access control lists. Integrity impact is high as elevated privileges allow the attacker to modify files, alter permissions, and make changes to systems that should be restricted to administrators. Availability impact is high since an attacker with escalated privileges could disrupt SMB services, delete critical files, or compromise domain infrastructure.
The EPSS score of 51.2% (97.8th percentile) indicates very high exploitation probability, placing this among the top 2.2% of tracked vulnerabilities for likelihood of exploitation. While the vulnerability requires low-level authentication (the attacker needs at least a standard user account), this is a relatively low bar in enterprise environments where any domain user credential suffices. The ransomware association is listed as unknown, but SMB-based privilege escalation is a well-established tactic in lateral movement and ransomware deployment chains. The breadth of affected Windows versions — spanning from Windows 10 1507 through Windows 11 24H2 — means virtually every modern Windows desktop environment is potentially exposed.
Exploit Maturity
CVE-2025-33073 has confirmed active exploitation and is listed in CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of November 10, 2025. The EPSS score of 51.2% (97.8th percentile) reflects a very high probability of exploitation. The Microsoft Security Response Center has published the official advisory with patch details. Vicarius has published both detection and mitigation scripts to assist organizations in identifying and protecting vulnerable systems. The ransomware usage status is unknown, but SMB privilege escalation vulnerabilities are historically among the most commonly exploited vectors in enterprise ransomware campaigns.
Remediation
- Apply Microsoft security updates immediately. Install the cumulative updates for all affected Windows versions as documented in the Microsoft advisory. Patched builds include Windows 10 1507 (10.0.10240.21034), Windows 10 1607 (10.0.14393.8148), Windows 10 1809 (10.0.17763.7434), Windows 10 21H2 (10.0.19044.5965), Windows 10 22H2 (10.0.19045.5965), Windows 11 22H2 (10.0.22621.5472), Windows 11 23H2 (10.0.22631.5472), and Windows 11 24H2 (10.0.26100.4270).
- Enforce SMB signing and encryption. Enable SMB signing on all systems to prevent tampering with SMB traffic, and enable SMB encryption where supported to protect data in transit from interception or manipulation.
- Restrict SMB access through network segmentation. Limit SMB traffic to only necessary network segments using firewall rules. Block SMB ports (445/TCP) at network boundaries and between segments where file sharing is not required.
- Deploy detection scripts to identify vulnerable systems. Use the Vicarius detection script to scan your environment for systems running vulnerable Windows builds, and prioritize patching based on exposure and criticality.
- Monitor for privilege escalation indicators. Review Windows Security Event Logs for suspicious logon events, unexpected privilege changes, and anomalous SMB session activity that could indicate exploitation attempts.
Technical Details
The CVSS v3.1 base score for CVE-2025-33073 is 8.8 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Attack Vector (AV:N) indicates the vulnerability is exploitable remotely over the network via SMB. Attack Complexity (AC:L) means no special conditions are required. Privileges Required (PR:L) indicates the attacker needs a low-privilege authenticated account, such as a standard domain user. User Interaction (UI:N) means no victim action is needed. Scope (S:U) is unchanged, and all three impact metrics — Confidentiality (C:H), Integrity (I:H), and Availability (A:H) — are rated high.
The vulnerability resides in the access control enforcement logic of the Windows SMB protocol implementation. When an authenticated user connects to an SMB resource, the Windows SMB server fails to properly validate the requesting user's privilege level for certain operations. This allows an attacker with a low-privilege account to perform actions that should require administrative privileges, effectively escalating their access level. The attack is conducted entirely over the network through standard SMB connections, requiring no special tools beyond the ability to initiate authenticated SMB sessions. Given the central role of SMB in Windows enterprise environments for file sharing, printer access, and inter-process communication, a privilege escalation vulnerability in this protocol has far-reaching implications for network security.
Frequently Asked Questions
What is CVE-2025-33073?
CVE-2025-33073 is a high-severity privilege escalation vulnerability in Windows SMB caused by improper access control. It allows an authenticated user with low privileges to elevate their access over the network, potentially gaining administrative control over affected systems.
Does CVE-2025-33073 require authentication to exploit?
Yes, the attacker needs a low-privilege authenticated account, such as a standard domain user credential. However, in enterprise environments, this is a relatively low bar since any compromised user account or service account can serve as the starting point for exploitation.
Which Windows versions are affected?
CVE-2025-33073 affects a wide range of Windows client versions including Windows 10 (versions 1507, 1607, 1809, 21H2, 22H2) and Windows 11 (versions 22H2, 23H2, 24H2). Each version has a specific patched build number that must be installed.
Could this vulnerability be used in ransomware attacks?
While the ransomware association is currently listed as unknown by CISA, SMB privilege escalation vulnerabilities are historically among the most commonly exploited attack vectors in enterprise ransomware campaigns. The ability to escalate privileges over the network aligns closely with typical ransomware lateral movement techniques.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.