CVE-2025-33073: high-severity vulnerability in Microsoft Windows 10 Version 1507
Windows SMB Client Elevation of Privilege Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA, has a public proof of concept and 1 threat group(s) use it.
Groups known to exploit this vulnerability (MITRE ATT&CK attribution).
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
A flaw in Windows SMB (file sharing protocol) allows someone already with network access to gain higher-level permissions they shouldn't have. This is serious because attackers can use it to take control of sensitive systems across the network.
Improper access control in the Windows SMB implementation permits an authorized network attacker to escalate privileges by exploiting insufficient permission validation during SMB protocol operations. Pre-condition requires existing network access; impact allows unauthorized elevation to higher privilege levels, potentially compromising system integrity and confidentiality.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.