CVE-2025-33073

Windows SMB Client Elevation of Privilege Vulnerability

Exploited in the wild. In CISA KEV since 2025‑10‑20. A vendor fix is available.

CVSS 3.18.8High EPSS percentile99th83% chance in 30 days CISA KEVListedsince 2025-10-20, due 2025-11-10
No public exploit known FixVendor fixNo build named by the sources

Published 2025-06-10Updated 2025-10-27Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether any of your devices run Microsoft Windows SMB Client on the affected versions (Windows Server 2008/2012/2012 R2/2008 R2/2016/2019/2022/2025 and Windows 10/11).
For each affected device, confirm the installed Windows update level matches or exceeds the fixed version for your edition (see step 3).
Apply the vendor fixes: upgrade Windows 10/Server 2016/Server 2019 to at least 10.0.19044.5965 / 10.0.19045.5965 / 10.0.17763.7434 / 10.0.14393.8148 as applicable; upgrade Windows 11 to at least 10.0.22621.5472 / 10.0.22631.5472 / 10.0.26100.4270 as applicable; upgrade Windows Server 2022 to at least 10.0.20348.3745 / 10.0.25398.1665 as applicable.
If a system can’t be patched right away, use the vendor mitigation/workaround guidance from Microsoft Update Guide for CVE-2025-33073 and restrict or isolate SMB network access until patching is completed.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Improper access control in Windows SMB allows an authorized attacker to elevate privileges over a network.

In plain language

Written by AI from the record

CVE-2025-33073 is a Windows SMB issue where an attacker with network access can gain higher privileges; most small businesses should treat it as urgent and patch soon.

CVE-2025-33073 is a Windows SMB Client elevation of privilege issue (CWE-284) where an authorized attacker can exploit improper access control to elevate privileges over the network; it is listed in CISA KEV with a remediation due date of 2025-11-10.

If you're affected

Complete takeover of affected systems
Account and admin privilege escalation
Malicious activity without clear access
Disruption from unauthorized control

What is it

SMB is how Windows devices share files and communicate over a local network (and sometimes beyond, depending on your setup). This vulnerability lets a network attacker who already has “authorized” access punch through Windows permissions and gain higher privileges than they should. Think of it like someone getting into a building with a valid badge, then finding a flaw to turn that badge into full keys.

Who is affected

This matters if you run Microsoft Windows SMB Client on any of these systems: Windows Server 2008, 2012, 2012 R2, 2008 R2, 2016, 2019, 2022, or 2025, and Windows 10 or Windows 11. If an attacker has authorized network access to the network path where SMB traffic can reach the machine, they may be able to elevate privileges without needing you to do anything. The risk is tied to whether the attacker can reach SMB over the network in your environment (and whether they can already access the network in an authorized way).

How urgent is it

This is RED because CISA listed CVE-2025-33073 in its KEV catalog, meaning real-world exploitation is considered credible enough to warrant government action. If your business relies on Windows file sharing or SMB connectivity, you should patch or mitigate immediately rather than waiting for additional reports.

What to do — in detail

Confirm whether you’re exposed

Inventory affected endpoints: list all devices running Windows 10, Windows 11, or any of the listed Windows Server versions (2008/2008 R2/2012/2012 R2/2016/2019/2022/2025).
For each device, verify whether the SMB client components are in use (commonly present on Windows) and whether the device is reachable over the network where SMB sessions could be established.
Check installed Windows update/build level against Microsoft’s fixed version numbers for your edition; if your build is below the fixed level, you are exposed.

Upgrade to the fixed versions (apply the matching fixed build)

Windows 10 fixed in:
- 10.0.10240.21034
- 10.0.14393.8148
- 10.0.17763.7434
- 10.0.19044.5965
- 10.0.19045.5965
Windows 11 fixed in:
- 10.0.22621.5472
- 10.0.22631.5472
- 10.0.26100.4270
Windows Server 2016 fixed in:
- 10.0.14393.8148
Windows Server 2019 fixed in:
- 10.0.17763.7434
Windows Server 2022 fixed in:
- 10.0.20348.3745
- 10.0.25398.1665

Patch timing and CISA due date

CISA KEV due date for remediation: 2025-11-10.

If patching is delayed (temporary containment)

Follow Microsoft’s mitigation/workaround guidance for CVE-2025-33073 (from the Update Guide).
Reduce network exposure of SMB: restrict SMB traffic to only the systems that truly need it (via firewall rules, network segmentation, and access control).
If you can’t apply the vendor fix immediately, prioritize patching for systems that are most reachable from other networks/clients or that handle file sharing.

What to monitor after changes

Confirm Windows update installation succeeded on all targeted machines.
Review for suspicious SMB-related authentication or privilege changes on any systems that might have been reachable before patching (use your existing logging/alerting process).

Technical context

Summary

CVE-2025-33073 is an elevation of privilege vulnerability affecting the Windows SMB Client due to improper access control (CWE-284). An authorized attacker with network access can exploit the weakness to elevate privileges on a remote system. User interaction is not required.

Exploitation status

KEV: Listed in CISA KEV (added 2025-10-20), which indicates active attention and expected real-world risk.
No clear dated public press exploitation claim is provided in the findings.
No public exploit code is on record.

Attack vector and conditions

Attack vector: network.
Prerequisite: authorized network access.
Reachability in default configuration: unknown (so exposure depends on whether SMB is reachable and how your environment is configured).

Fix availability

Vendor fixed versions are provided for Windows 10, Windows 11, and specific Windows Server branches (2016/2019/2022). Apply the matching fixed version for your OS build/branch.

EPSS

A predicted likelihood exists in the findings, but given the KEV listing, KEV takes precedence for urgency.

Meaning of KEV

KEV is CISA’s catalog of vulnerabilities where exploitation risk is considered sufficiently high to require timely remediation; this is reflected by the CISA due date included in the findings.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS99th

CISA KEV

Listed as exploited in the wild since 2025-10-20.

US federal agencies must remediate by 2025-11-10.

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

83% chance of exploitation activity in the next 30 days, which ranks it in the 99th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

9 events over 380 days, from the signal feeds we watch.

2026-06-25OpenVAS check added
2026-06-22EPSS band changemoderate → high
2026-03-30EPSS band changehigh → moderate
2025-10-27Patch availableworkaround available, record updated
2025-10-20Added to CISA KEV
2025-06-10Publishedweakness classified

Affected products

Microsoft Corpcommercial · USaka microsoft, microsoft corporation

And 57 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Scored 8.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable

Weaknesses

CWE-284No name in the record

Sources

References in the record

And 6 more references. See all after sign-in

In the news

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next exploited one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for Microsoft Corp, not every advisory. This one: actively exploited.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account