What is the CVSS score of CVE-2025-33054?

CVE-2025-33054 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

How to fix or mitigate CVE-2025-33054?

Within 24 hours: Identify all systems running affected Remote Desktop Client versions and prepare patch deployment plan. Within 7 days: Apply vendor-released patch to all Remote Desktop Client installations; prioritize administrative and sensitive system access points. Within 30 days: Verify patch deployment completion across entire organization and conduct user awareness training on recognizing social engineering attempts exploiting this vulnerability type.

Windows 11 22h2 CVE-2025-33054

Q: Which versions of Windows 11 22h2 are affected by CVE-2025-33054?

CVE-2025-33054 affects Remote Desktop Client and involves insufficient UI warnings for dangerous operations, enabling attackers to trick users into executing harmful actions without adequate security…. A patch is available.

EUVD-2025-20659 HIGH

Insufficient UI Warning of Dangerous Operations (CWE-357)

2025-07-08 secure@microsoft.com

Authentication Bypass Microsoft Windows 11 22h2 Windows 11 23h2 Windows 11 24h2 Windows Server 2025

8.1

CVSS 3.1 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-357 OWASP Top 10:2025 A06:2021 - Vulnerable and Outdated Components ASVS 5.0 V6 - Authentication Insufficient UI warning of dangerous op
Impact	CVSS 8.1. EPSS 0.1%. No patch confirmed.
Exploit ScenarioDerived	An attacker could exploit this vulnerability in Insufficient UI warning of dangerous operations in Remote Desktop Client to compromise the security of affected deployments, potentially impacting confidentiality, integrity, or availability.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 16, 2026

A security vulnerability in Insufficient UI warning of dangerous operations in Remote Desktop Client (CVSS 8.1) that allows an unauthorized attacker. High severity vulnerability requiring prompt remediation.

Earlier versions of this analysis (1)

v1 Mar 16, 2026 - 04:21 CVSS 8.1

Insufficient UI warning of dangerous operations in Remote Desktop Client allows an unauthorized attacker to perform spoofing over a network.

RemediationAI

Monitor vendor channels for patch availability.

Affected VersionsENISA

Windows 11 Version 23H2 10.0.22631.0 <10.0.22631.5624

Windows Server 2025 (Server Core installation) 10.0.26100.0 <10.0.26100.4652

Windows 11 version 22H3 10.0.22631.0 <10.0.22631.5624

Windows 11 Version 24H2 10.0.26100.0 <10.0.26100.4652

Windows Server 2025 10.0.26100.0 <10.0.26100.4652

Windows 11 version 22H2 10.0.22621.0 <10.0.22621.5624

Affected Packages

euvd windows_11_version_22h2 fix: 10.0.22621.5624

euvd windows_11_version_22h3 fix: 10.0.22631.5624

euvd windows_11_version_23h2 fix: 10.0.22631.5624

euvd windows_11_version_24h2 fix: 10.0.26100.4652

euvd windows_server_2025 fix: 10.0.26100.4652

euvd windows_server_2025_server_core_installation fix: 10.0.26100.4652

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 6 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Vulnerability type not specified by vendor. CVSS 8.1 indicates high severity. Affects Insufficient UI warning of dangerous operations in Remote Desktop Client.

Know when Windows 11 22h2 gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 8.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

10.0.22631.5624,10.0.26100.4652,10.0.22621.5624

CVE Published

Jul 08, 2025 - 17:15 nvd

HIGH 8.1

DescriptionCVE.org

Insufficient UI warning of dangerous operations in Remote Desktop Client allows an unauthorized attacker to perform spoofing over a network.

Executive ViewAI

Why It Matters

CVE-2025-33054 affects Remote Desktop Client and involves insufficient UI warnings for dangerous operations, enabling attackers to trick users into executing harmful actions without adequate security prompts. This could allow unauthorized access or control of systems accessed via RDP, directly impacting any organization using Remote Desktop for administrative or user access.

Business Impact: High

Compensating Controls

Apply vendor patch. Pending patch deployment, implement compensating controls: restrict RDP access to trusted networks only via firewall rules; enforce multi-factor authentication on all RDP sessions; disable RDP on non-essential systems; monitor RDP session logs for suspicious activity; conduct user training on verifying operations before confirmation.

Threat Intelligence Overview

EPSS Score

0.1%

Top 81% exploitable

Data Quality

4 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.1%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +40

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

More in Windows 11 22h2

View all

CVE-2021-34527 HIGH Act Now POC

8.8 Jul 02

<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi

CVE-2023-36884 HIGH Act Now POC

7.5 Jul 11

Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo

CVE-2024-21412 HIGH Act Now POC

8.1 Feb 13

Internet Shortcut Files Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is rem

CVE-2023-44487 HIGH Act Now POC

7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour

CVE-2024-30088 HIGH Act Now POC

7.0 Jun 11

Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR

CVE-2025-33053 HIGH Act Now POC

8.8 Jun 10

Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables

CVE-2025-33073 HIGH Act Now POC

8.8 Jun 10

Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker

CVE-2024-21338 HIGH Act Now POC

7.8 Feb 13

Windows Kernel Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack co

CVE-2013-3900 MEDIUM Act Now

5.5 Dec 11

Why is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update

CVE-2025-21293 HIGH Act Now POC

8.8 Jan 14

Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users

CVE-2024-35250 HIGH Act Now POC

7.8 Jun 11

Windows Kernel-Mode Driver Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is l

CVE-2024-43461 HIGH Act Now

8.8 Sep 10

Windows MSHTML Platform Spoofing Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitab

Same weakness CWE-357 – Insufficient UI Warning of Dangerous Operations

View all

CVE-2025-49582 HIGH POC

8.0

CVE-2025-49587 HIGH POC

8.0

CVE-2025-49585 HIGH POC

8.0

CVE-2024-43505 HIGH

7.8

CVE-2021-22645 HIGH

7.8

CVE-2026-26151 HIGH

7.1

CVE-2022-41904 MEDIUM

6.5

CVE-2024-30058 MEDIUM

5.4

Same technique Authentication Bypass

View all

CVE-2015-3306 CRITICAL POC

10.0

CVE-2023-22515 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2013-2465 CRITICAL POC

9.8

CVE-2011-3544 CRITICAL POC

9.8

CVE-2022-40684 CRITICAL POC

9.8

CVE-2025-61882 CRITICAL POC

9.8

CVE-2024-0012 CRITICAL POC

9.3

References

Advisories & patches

ADVISORY https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-33054 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-33054

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back