Windows SMB Client CVE-2025-33073: Relay to SYSTEM

What to do

1. Confirm every domain-joined Windows host is at or above its June 2025 fixed build, preferably on the latest cumulative update.
2. Require SMB signing for incoming connections on clients and servers through Group Policy ('Microsoft network server: Digitally sign communications (always)').
3. Verify with Get-SmbServerConfiguration | Select-Object RequireSecuritySignature and test older NAS devices, scanners and appliances before enforcing broadly.
4. Review who can create records in AD-integrated DNS zones, since the published technique registers a crafted DNS name as an ordinary domain user.
5. Reduce authentication coercion paths such as PetitPotam (MS-EFSR) on servers that do not need them.

How to check if you are affected or compromised

• Search AD-integrated DNS zones for host names containing 1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA, the marshalled suffix used in the published technique.
• Review directory service change auditing (Event ID 5137) for DNS node objects created by ordinary user accounts.
• Look for unexpected Remote Registry service starts and remote SAM hive reads on workstations and servers.
• Hunt for machines authenticating over SMB to unusual internal hosts right after EFSRPC calls, a sign of coercion.

What happened#

On June 10, 2025, Microsoft fixed CVE-2025-33073, an improper access control flaw (CWE-284) in the Windows SMB client. Its advisory says an attacker can "coerce the victim machine to connect back to the attacker's SMB Server using SMB and authenticate," and gain SYSTEM. Microsoft scores it CVSS 3.1 8.8. At release it marked the bug publicly disclosed but not exploited, and its update guide still says so.

That changed on October 20, 2025, when CISA added the CVE to its KEV catalog with a November 10 federal deadline. CISA shared no details, and Help Net Security noted that public proof-of-concept exploits were already available. Who used it in the wild was not disclosed as of Oct 23, 2026.

Microsoft credits seven reporters, including Google Project Zero, CrowdStrike and Synacktiv. RedTeam Pentesting found it on January 30, 2025 and reported it on March 7. Its write-up describes coercing a host to authenticate and relaying its own Kerberos ticket back to it. The session that came back had SYSTEM rights, not the computer account's.

Synacktiv explains why. The attacker registers a DNS name with marshalled target information appended, such as srv11UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA. It then coerces the target, for example with PetitPotam. Windows strips the suffix, decides the target is itself, and falls back to local authentication, handing over a SYSTEM token. Microsoft's patch in mrxsmb.sys blocks SMB connections to names that carry marshalled data.

Who is affected#

Windows 10, Windows 11 through 24H2 and Windows Server 2008 SP2 through 2025 before the June 2025 update. Fixed builds include 26100.4349 for Windows 11 24H2 and Server 2025, 22631.5472 for Windows 11 23H2, 19045.5965 for Windows 10 22H2, and 20348.3807 for Server 2022 (CVE record). RedTeam says the attack hits domain-joined hosts that do not require SMB signing on incoming connections. By default that covers Windows 10 and 11 up to 23H2 and every Windows Server version except domain controllers.

Do you really need to act?#

Check, and fix signing while you are there. The attacker needs a domain account, a way to add a DNS record, and a coercion method. All three are common inside a network. A patched host is safe. Synacktiv notes that "enforcing SMB signing prevents the exploitation of this vulnerability, even without applying the patch." It also says the patched bug may still be reachable if someone finds an alternative to the DNS record trick. Do not wait for Microsoft's exploited flag to change before patching.

What to do now#

1. Confirm each domain-joined host is at or above its June 2025 build, ideally on the latest cumulative update.
2. Require SMB signing for incoming connections through Group Policy, or with Set-SmbServerConfiguration -RequireSecuritySignature $true. Check with Get-SmbServerConfiguration | Select-Object RequireSecuritySignature.
3. Test old NAS devices, scanners and appliances before enforcing signing widely.
4. Review who can create records in AD-integrated DNS zones, and reduce coercion paths such as PetitPotam.

How to tell if you were hit#

• Search DNS for the marshalled suffix: Get-DnsServerResourceRecord -ZoneName corp.example.com | Where-Object HostName -like '*1UWhRCAAAA*'.
• Review Event ID 5137 for DNS node objects created by ordinary users.
• Look for unexpected Remote Registry service starts and remote SAM reads, which the researchers used after gaining SYSTEM.

Timeline#

• Jan 30, 2025 — RedTeam Pentesting finds the flaw.
• Mar 7, 2025 — Reported to MSRC.
• Jun 10, 2025 — Microsoft ships the fix.
• Jun 11, 2025 — RedTeam and Synacktiv publish details.
• Oct 20, 2025 — CISA adds the CVE to KEV.
• Nov 10, 2025 — Federal remediation deadline.

Vulnerability records

• CVE-2025-33073 · KEV 2025-10-20 · Improper access control in Windows SMB allows an authorized attacker to elevate privileges over a network.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Microsoft — CVE-2025-33073 Windows SMB Client Elevation of Privilege Vulnerability msrc.microsoft.com
2. CVE record — CVE-2025-33073 cve.org
3. NVD — CVE-2025-33073 nvd.nist.gov
4. CISA — Known Exploited Vulnerabilities: CVE-2025-33073 cisa.gov
5. RedTeam Pentesting — Advisory RT-SA-2025-002: Reflective Kerberos Relay Attack redteam-pentesting.de
6. RedTeam Pentesting — A Look in the Mirror: The Reflective Kerberos Relay Attack blog.redteam-pentesting.de
7. Synacktiv — NTLM reflection is dead, long live NTLM reflection! An in-depth analysis of CVE-2025-33073 synacktiv.com

Coverage and analysis

1. Help Net Security — CISA warns of Windows SMB flaw under active exploitation (CVE-2025-33073) helpnetsecurity.com