Microsoft Windows SMB Client Improper Access Control Vulnerability

Silence

same day

First public report to first vendor statementUnverified source

Exposure

same day

First public report to first fix

Follow-through

same day

First public report to a fix for every supported version

• Vendor silent
• Vendor statement, no fix
• Fixed for some versions
• Fixed when disclosed
• Date only, no time of day

1. First public report

   10 Jun 2025, 17:02 UTC

   CVE.org record CVE-2025-33073ClaimedQuote verifiedEvidence

   Improper access control in Windows SMB allows an authorized attacker to elevate privileges over a network.

   CVE record published.

   Source

   CVE.org record CVE-2025-33073 cve record

   Recorded time

   10 Jun 2025, 17:02 UTC

   Precision

   To the minute

   Origin

   Claimed. The date the source gives.

   Quote check

   Found in the archived copy

   Snapshot

   sha256:84902eeb8141d4e8…

   Used in metrics

   Yes

   Dispute this timestamp

   5 more sources for this moment

   Bluesky postClaimedQuote not checked yet6 Jun 2025, 13:39 UTCEvidence

   Sicherheitshinweis bekommen: RedTeam Pentesting hat eine kritische Schwachstelle in Windows entdeckt. Die ID der Schwachstelle ist CVE-2025-33073... 1 Kommentar, 201 mal gelesen.

   Earliest third-party post we hold.

   Source

   Bluesky post social

   Recorded time

   6 Jun 2025, 13:39 UTC

   Precision

   To the minute

   Origin

   Claimed. The date the source gives.

   Quote check

   Not checked yet

   Snapshot

   No archived snapshot

   Used in metrics

   No, kept for the record

   Dispute this timestamp

   Microsoft advisory CVE-2025-33073ClaimedQuote not found in archive10 Jun 2025Evidence

   Windows SMB Client Elevation of Privilege Vulnerability. Improper access control in Windows SMB allows an authorized attacker to elevate privileges over a network. [Publicly

   The vendor's own disclosure.

   Source

   Microsoft advisory CVE-2025-33073 vendor advisory

   Recorded time

   10 Jun 2025

   Precision

   Date only (no time of day is shown)

   Origin

   Claimed. The date the source gives.

   Quote check

   Not found in the archived copy. Treat with caution.

   Snapshot

   sha256:9e95aa7832f9347c…

   Used in metrics

   No, kept for the record

   Dispute this timestamp

   Mastodon postClaimedQuote not checked yet11 Jul 2025, 21:30 UTCEvidence

   📢 Découverte et impact de la faille CVE-2025-33073 dans Active Directory 📝 L'article publié par Cameron Stish sur GuidePoint Security relate la découverte et l'impact de la vulnérabilité **CVE-2025-33073**, une

   Earliest third-party post we hold.

   Source

   Mastodon post social

   Recorded time

   11 Jul 2025, 21:30 UTC

   Precision

   To the minute

   Origin

   Claimed. The date the source gives.

   Quote check

   Not checked yet

   Snapshot

   No archived snapshot

   Used in metrics

   No, kept for the record

   Dispute this timestamp

   CISA KEV (CVE-2025-33073)ClaimedQuote verified20 Oct 2025Evidence

   Microsoft Windows SMB Client Improper Access Control Vulnerability

   Added to CISA's KEV catalog on 2025-10-20.

   Source

   CISA KEV (CVE-2025-33073) kev

   Recorded time

   20 Oct 2025

   Precision

   Date only (no time of day is shown)

   Origin

   Claimed. The date the source gives.

   Quote check

   Found in the archived copy

   Snapshot

   sha256:ef8fffede5c47200…

   Used in metrics

   No, kept for the record

   Dispute this timestamp

   Hacker NewsClaimedQuote not checked yet27 Mar 2026, 15:54 UTCEvidence

   standard practice across most Active Directory environments. But this hardening may have created a false sense of security. CVE-2025-33073 changes the calculus by removing the prerequisite of admin access, enabling NTLM relay attack Active Directory exploitation through unconstrained delegation.

   Earliest third-party post we hold.

   Source

   Hacker News hn

   Recorded time

   27 Mar 2026, 15:54 UTC

   Precision

   To the minute

   Origin

   Claimed. The date the source gives.

   Quote check

   Not checked yet

   Snapshot

   No archived snapshot

   Used in metrics

   No, kept for the record

   Dispute this timestamp

2. Vendor statement

   10 Jun 2025date onlysame dayUnverified: quote not found in the archived copy

   Microsoft advisory CVE-2025-33073ClaimedQuote not found in archiveEvidence

   Windows SMB Client Elevation of Privilege Vulnerability. Improper access control in Windows SMB allows an authorized attacker to elevate privileges over a network. [Publicly

   Source

   Microsoft advisory CVE-2025-33073 vendor advisory

   Recorded time

   10 Jun 2025

   Precision

   Date only (no time of day is shown)

   Origin

   Claimed. The date the source gives.

   Quote check

   Not found in the archived copy. Treat with caution.

   Snapshot

   sha256:9e95aa7832f9347c…

   Used in metrics

   Yes

   Dispute this timestamp

3. First workaround

   No official mitigation found yet.

4. First fix

   10 Jun 2025date onlysame day

   Microsoft advisory CVE-2025-33073ClaimedQuote verifiedEvidence

   Information published.

   Vendor Fix listed at the first revision

   Source

   Microsoft advisory CVE-2025-33073 vendor advisory

   Recorded time

   10 Jun 2025

   Precision

   Date only (no time of day is shown)

   Origin

   Claimed. The date the source gives.

   Quote check

   Found in the archived copy

   Snapshot

   sha256:19332be3e5fd75a3…

   Used in metrics

   Yes

   Dispute this timestamp

5. Fixed for all versions

   10 Jun 2025date onlysame day

   Microsoft advisory CVE-2025-33073ClaimedQuote verifiedEvidence

   Information published.

   every Known Affected product has a Vendor Fix and no later revision announces more updates

   Source

   Microsoft advisory CVE-2025-33073 vendor advisory

   Recorded time

   10 Jun 2025

   Precision

   Date only (no time of day is shown)

   Origin

   Claimed. The date the source gives.

   Quote check

   Found in the archived copy

   Snapshot

   sha256:19332be3e5fd75a3…

   Used in metrics

   Yes

   Dispute this timestamp

No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.