EUVD-2025-17737Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 8.8 (High). KEV-listed — actively exploited. EPSS 57.6% — high exploitation probability. Public PoC available. Requires only domain authentication (any user). SMB is ubiquitous in Windows networks. Enables mass lateral movement. |
| Exploit ScenarioDerived | After compromising a single domain user account (through phishing, credential stuffing, or another vulnerability), an attacker sends crafted SMB requests to other Windows systems on the network. The improper access control allows escalation to SYSTEM on the target systems. The attacker can rapidly compromise multiple systems across the domain, dumping credentials, accessing file shares, and establishing persistent access — all using the legitimate SMB protocol that is difficult to block in Windows environments. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 14, 2026
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attackers to escalate privileges over the network. KEV-listed with EPSS 57.6% and public PoC, this vulnerability in the core Windows file sharing protocol affects every Windows system on the network, enabling lateral movement from any compromised domain account to SYSTEM-level access on SMB-accessible systems.
Earlier versions of this analysis (1)
Windows SMB contains an improper access control vulnerability (CWE-284) that allows authenticated network users to escalate privileges to SYSTEM on remote systems through crafted SMB requests.
RemediationAI
Apply Microsoft security update immediately across all Windows systems. This is a network-worm-capable vulnerability — patch everything. Monitor for unusual SMB authentication patterns. Consider SMB signing and encryption enforcement. Segment networks to limit SMB exposure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 25 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SMB (Server Message Block) is the primary file and print sharing protocol in Windows networks. The access control flaw allows an authenticated user (any domain account) to escalate privileges on remote systems through the SMB protocol. Because SMB is enabled by default on all Windows systems and is the foundation of Windows domain file sharing, this vulnerability provides a powerful lateral movement technique — any compromised domain account can escalate to SYSTEM on any reachable Windows system.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Improper access control in Windows SMB allows an authorized attacker to elevate privileges over a network.
Executive ViewAI
CVE-2025-33073 is a high-severity Windows SMB privilege escalation vulnerability actively exploited in the wild that allows any compromised domain account to gain SYSTEM-level access across your network infrastructure. This critical flaw in Windows file sharing directly enables lateral movement and domain compromise, putting all Windows systems with SMB exposure at immediate risk of unauthorized administrative control.
Apply vendor patch. Interim mitigations pending patch deployment: restrict SMB network access via firewall rules limiting port 445 between trust boundaries; disable SMB v1 protocol if v2/v3 is available; enforce multi-factor authentication on privileged accounts to reduce compromised credential impact; monitor SMB authentication logs for lateral movement attempts.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
Exploit-DB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then
Same weakness CWE-284 – Improper Access Control
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: High| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
GitHub PoC