CVE-2025-54918
Published: 09 September 2025
Summary
CVE-2025-54918 is a high-severity Improper Authentication (CWE-287) vulnerability in Microsoft Windows Server 2008. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 41.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and IA-2 (Identification and Authentication (Organizational Users)).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the improper authentication flaw in Windows NTLM by applying vendor security patches.
Enforces configuration settings to disable or restrict vulnerable NTLM authentication usage over the network.
Requires identification and authentication for organizational users using mechanisms that avoid the flawed NTLM protocol.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Improper NTLM authentication enables network-based credential validation bypass by low-privileged attackers, directly facilitating privilege escalation.
NVD Description
Improper authentication in Windows NTLM allows an authorized attacker to elevate privileges over a network.
Deeper analysisAI
CVE-2025-54918 is an improper authentication vulnerability (CWE-287) in the Windows NTLM authentication protocol, published on 2025-09-09. It affects Windows systems that rely on NTLM for network authentication, enabling an authorized attacker to bypass proper credential validation.
The vulnerability can be exploited by an attacker with low privileges (PR:L) over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). Successful exploitation allows privilege escalation, resulting in high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), with an overall CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Microsoft's advisory provides guidance on mitigation and patching; see https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54918 for details.
Details
- CWE(s)