What is the CVSS score of CVE-2025-33068?

CVE-2025-33068 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 26.8%.

Which versions of Windows are affected by CVE-2025-33068?

CVE-2025-33068 is a high-severity denial-of-service vulnerability in Windows Standards-Based Storage Management Service that allows unauthenticated network attackers to disrupt storage operations…. A patch is available.

How to fix or mitigate CVE-2025-33068?

Within 24 hours: Identify all Windows servers running Standards-Based Storage Management Service and confirm patch availability from Microsoft. Within 7 days: Test and deploy the available vendor patch to non-production servers; apply to production systems on an expedited schedule based on business criticality. Within 30 days: Complete patch deployment across all affected systems and validate storage management service functionality post-remediation.

Windows CVE-2025-33068

EUVD-2025-17740 HIGH

Uncontrolled Resource Consumption (CWE-400)

2025-06-10 secure@microsoft.com

Windows Denial Of Service Microsoft Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:41 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

10.0.14393.8148,10.0.20348.3807,10.0.26100.4349

EUVD ID Assigned

Mar 14, 2026 - 19:49 euvd

EUVD-2025-17740

Analysis Generated

Mar 14, 2026 - 19:49 vuln.today

CVE Published

Jun 10, 2025 - 17:22 nvd

HIGH 7.5

DescriptionCVE.org

Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service over a network.

AnalysisAI

Windows Standards-Based Storage Management Service contains an uncontrolled resource consumption vulnerability allowing unauthenticated network attackers to cause denial of service. The service manages storage operations and its disruption affects storage provisioning and management on Windows servers.

Technical ContextAI

The Standards-Based Storage Management Service (smphost) manages SMI-S based storage operations on Windows servers. An uncontrolled resource consumption flaw allows remote attackers to exhaust service resources without authentication, causing storage management operations to fail.

RemediationAI

Apply the Microsoft security update. Restrict network access to the storage management service port. Monitor service health for resource consumption anomalies.