CVE-2025-33073: A Windows SMB Client vulnerability allows unauthorized access. Our AI agents detected active exploitation. Harden SMB config

CVE-2025-33073 is an improper access control flaw in the Windows SMB client that lets an authorized attacker escalate privileges over a network to NT AUTHORITY\SYSTEM when SMB signing is not cryptographically enforced. Microsoft assigned it a CVSS 3.1 base score of 8.8 and published the vendor advisory on June 10, 2025. The vulnerable component covers Windows 10, Windows 11, and Windows Server builds including 2019, 2022, and 2025; Rapid7 lists cumulative updates such as KB5060526 for Server 2022 22H2, KB5060842 for Windows 11 24H2, and KB5060533 for Windows 10 22H2 as fixes released in June 2025. CISA confirmed active exploitation by adding the CVE to the Known Exploited Vulnerabilities catalog on October 20, 2025.

This is not another theoretical SMB bug. Because the attack requires only that SMB signing be optional and that the attacker can coerce authentication (LLMNR or NBNS poisoning, WebDAV coercion, or UNC path lures), any Windows estate where TCP 445 is reachable internally is exposed. The original event notes AI agents detected active exploitation, aligning with CISA's KEV entry and the public proof-of-concept artifacts that lowered the barrier to entry. The victim gains full SYSTEM-level control, which means credential material access, scheduled-task persistence, and lateral movement through a domain. The story carries a score of only 0.1 despite a base severity of 5.5 and a KEV flag, indicating the engine's pickup and velocity metrics have not caught up; a defender should treat it as an outlier requiring immediate prioritization rather than a routine patch cycle item.

Defenders must apply Microsoft's June 2025 cumulative updates for all supported Windows versions and enforce SMB signing via Group Policy (Microsoft network client: Digitally sign communications always; server: Digitally sign communications always). Network controls should block SMB TCP 445 to and from untrusted segments and the internet. For hunting, disable LLMNR and NetBIOS over TCP/IP via GPO, enforce Extended Protection for Authentication, and restrict NTLM through Domain and Local Security Policy. Monitor for unsigned SMB sessions and unexpected admin share access from user subnets, since the event title explicitly references unauthorized access through hardened SMB configuration gaps.

Watch for two developments that would shift this assessment: first, any new Microsoft patch revision or out-of-band update indicating the June 2025 fixes are incomplete, and second, telemetry from GreyNoise or Shodan showing broader exploitation campaigns beyond the CISA-confirmed activity. If either appears, the exposure assumption moves from targeted coercion to widespread scanning and the priority escalates accordingly.