CVE-2025-33073
Published: 10 June 2025
Summary
CVE-2025-33073 is a high-severity Improper Access Control (CWE-284) vulnerability in Microsoft Windows Server 2008. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 2.4% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-17 (Remote Access).
Deeper analysis
CVE-2025-33073 is an improper access control vulnerability in Windows SMB that permits privilege escalation over a network. The flaw is tracked under CWE-284 and carries a CVSS 3.1 score of 8.8, reflecting network attack vector, low complexity, and low required privileges. It affects Microsoft Windows SMB components across supported Microsoft products.
An authorized attacker with valid credentials can exploit the weakness remotely to obtain higher privileges on the target system, potentially leading to full control over affected hosts.
Microsoft's advisory at msrc.microsoft.com details the issue and available updates, while Vicarius has published detection and mitigation scripts for environments where immediate patching is delayed. The vulnerability is also listed in CISA's Known Exploited Vulnerabilities catalog, indicating confirmed in-the-wild use.
EPSS for the CVE rose from lower values after disclosure to a peak of 0.5758 on 2026-03-14 before receding to the current 0.4433, signaling sustained exploitation interest that warrants ongoing monitoring.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-17737
Vulnerability details
Improper access control in Windows SMB allows an authorized attacker to elevate privileges over a network.
- CWE(s)
- KEV Date Added
- 20 October 2025
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces access control policies on SMB shares and sessions to block unauthorized privilege elevation by authorized users.
Limits privileges granted to SMB-authenticated accounts so that an authorized low-privilege attacker cannot escalate rights.
Requires explicit authorization and security controls for all network-based SMB remote access, reducing the attack surface for this network vector.