CVE-2025-33073: Microsoft Windows SMB Client Improper Access Control
Microsoft Windows SMB Client Improper Access Control Vulnerability. Microsoft Windows SMB Client contains an improper access control vulnerability that could allow for privilege escalation. An attacker could execute a specially crafted malicious script to coerce the victim machine to connect back to the attack system using SMB and authenticate.
- CISA KEV-listed (remediation due 2025-11-10)
- EPSS 80.4% (99.6% percentile)
- CVSS 8.8 high
Detection rules
- Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing - Network high
- Potential Kerberos Coercion by Spoofing SPNs via DNS Manipulation high
- Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing high
- Attempts of Kerberos Coercion Via DNS SPN Spoofing high
Related briefings
Linked threat actors
- The Gentlemen machine-inferred link