What happened
Microsoft Windows SMB Client contains an improper access control vulnerability that could allow for privilege escalation. An attacker could execute a specially crafted malicious script to coerce the victim machine to connect back to the attack system using SMB and authenticate.
Affected versions
Windows: See original advisory Fixed: See vendor advisory.
Why it matters
This source correlation may provide earlier visibility while structured CVE metadata is still being updated.
Detection & mitigation
- Review the original advisory and validate affected versions.
- Apply vendor-provided updates or mitigations when available.
Public PoC references
RepositoryAuthorFirst seenReference
Exploit-DB 52330Windows 11 SMB Client - Privilege Escalation & Remote Code Execution (RCE)Mohammed Idrees Banyamer2025-06-15VerifiedSploitusNTLM reflection and coercion in Windows Server 2025 lets a domain user escalate to Domain Admin.KitPloit2026-08-24T23:01:33Candidatekitploit.comNTLM reflection and coercion in Windows Server 2025 lets a domain user escalate to Domain Admin.ru2026-08-24T23:01:33CandidatePoC-in-GitHub · mverschu/CVE-2025-33073PoC Exploit for the NTLM reflection SMB flaw.★ 717mverschu2025-06-13CandidatePoC-in-GitHub · starscow/CVE-2025-33073PoC Exploit for the NTLM reflection SMB flaw.★ 0starscow2025-06-17CandidatePoC-in-GitHub · obscura-cert/CVE-2025-33073★ 1obscura-cert2025-06-28CandidatePoC-in-GitHub · matejsmycka/CVE-2025-33073-checkerThis rough PoC checker script tests targets for CVE-2025-33073 vulnerability by attempting to perform NTLM reflection attacks using NTLM auth coercion via samba RPC, to do this you need to have account with access to the samba.★ 0matejsmycka2025-07-31CandidatePoC-in-GitHub · cve-2025-33073/cve-2025-33073★ 0cve-2025-330732025-09-06CandidatePoC-in-GitHub · SFRDevelopment/windows-smb-vulnerability-framework-cve-2025-33073Proof-of-Concept★ 6SFRDevelopment2025-10-18CandidatePoC-in-GitHub · uziii2208/CVE-2025-33073Universal exploitation tool for CVE-2025-33073 targeting Windows Domain Controllers with DNSAdmins privileges and WinRM enabled.★ 67uziii22082025-11-14CandidatePoC-in-GitHub · irjfifndn-prog/Blackash-CVE-2025-33073CVE-2025-33073★ 0irjfifndn-prog2025-11-17CandidatePoC-in-GitHub · EgCupCake/cupntlm-Automated-Exploit-For-CVE-2025-33073-cupntlm★ 3EgCupCake2026-03-09CandidatePoC-in-GitHub · IyarGross/SMB-CVE-2025-33073Advanced SMB Honeypot: CVE-2025-33073 Research & Implementation★ 0IyarGross2026-03-11CandidatePoC-in-GitHub · sentinel-aidefense/CVE-2025-33073CVE-2025-33073 Research writeup★ 0sentinel-aidefense2026-07-13CandidateSource timeline
Discovered through CISA Known Exploited VulnerabilitiesView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Record history
Record created from the first normalized source observation.
Metadata and source references refreshed.