---
title: "Windows SMB Client CVE-2025-33073: Relay to SYSTEM"
url: https://erroneo.us/security/briefs/windows-smb-client-cve-2025-33073-reflective-relay/
description: "A June 2025 Windows SMB client flaw lets a domain user reflect a host's own login back to it for SYSTEM; in KEV since Oct 2025. Patch and require SMB signing."
type: security-brief
section: "Security Digest"
date_published: 2025-06-10
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2025-33073"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Windows SMB Client CVE-2025-33073: Relay to SYSTEM

**Verdict: Check exposure.** Fixed in June 2025 and exploited since; confirm every domain-joined host has the update and, just as important, require SMB signing on incoming connections, which blocks this relay even on unpatched machines.

- **Who must act:** Active Directory environments with domain-joined Windows clients or servers below the June 2025 builds, especially where hosts do not require SMB signing for incoming connections.
- **Who can relax:** Hosts on current cumulative updates that also require server-side SMB signing; the published attack targets domain-joined machines.
- **Affected:** Windows 10, Windows 11 through 24H2, and Windows Server 2008 SP2 through Server 2025, before the June 10, 2025 updates; Exploitable in practice on domain-joined hosts that do not require SMB signing on incoming connections; by default, per RedTeam Pentesting, Windows 10 and 11 up to 23H2 and Windows Server except domain controllers
- **Fixed:** Windows 11 24H2 and Server 2025 build 26100.4349 (KB5060842); Windows 11 23H2 build 22631.5472 (KB5060999); Windows 10 22H2 build 19045.5965 (KB5060533); Windows Server 2022 build 20348.3807 (KB5060526); Windows Server 2019 build 17763.7434 (KB5060531); Windows Server 2016 build 14393.8148 (KB5061010)
- **CVEs:** CVE-2025-33073
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Confirm every domain-joined Windows host is at or above its June 2025 fixed build, preferably on the latest cumulative update.
2. Require SMB signing for incoming connections on clients and servers through Group Policy ('Microsoft network server: Digitally sign communications (always)').
3. Verify with Get-SmbServerConfiguration | Select-Object RequireSecuritySignature and test older NAS devices, scanners and appliances before enforcing broadly.
4. Review who can create records in AD-integrated DNS zones, since the published technique registers a crafted DNS name as an ordinary domain user.
5. Reduce authentication coercion paths such as PetitPotam (MS-EFSR) on servers that do not need them.

### How to check if you are affected

- Search AD-integrated DNS zones for host names containing 1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA, the marshalled suffix used in the published technique.
- Review directory service change auditing (Event ID 5137) for DNS node objects created by ordinary user accounts.
- Look for unexpected Remote Registry service starts and remote SAM hive reads on workstations and servers.
- Hunt for machines authenticating over SMB to unusual internal hosts right after EFSRPC calls, a sign of coercion.

## What happened

On June 10, 2025, Microsoft fixed CVE-2025-33073, an improper access control flaw (CWE-284) in the Windows SMB client. Its [advisory](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-33073) says an attacker can "coerce the victim machine to connect back to the attacker's SMB Server using SMB and authenticate," and gain SYSTEM. Microsoft scores it CVSS 3.1 8.8. At release it marked the bug publicly disclosed but not exploited, and its update guide still says so.

That changed on October 20, 2025, when CISA added the CVE to its [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-33073) with a November 10 federal deadline. CISA shared no details, and [Help Net Security](https://www.helpnetsecurity.com/2025/10/21/cisa-warns-of-windows-smb-flaw-under-active-exploitation-cve-2025-33073/) noted that public proof-of-concept exploits were already available. Who used it in the wild was not disclosed as of Oct 23, 2026.

Microsoft credits seven reporters, including Google Project Zero, CrowdStrike and Synacktiv. [RedTeam Pentesting](https://www.redteam-pentesting.de/advisories/rt-sa-2025-002/) found it on January 30, 2025 and reported it on March 7. Its [write-up](https://blog.redteam-pentesting.de/2025/reflective-kerberos-relay-attack/) describes coercing a host to authenticate and relaying its own Kerberos ticket back to it. The session that came back had SYSTEM rights, not the computer account's.

[Synacktiv](https://www.synacktiv.com/en/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025) explains why. The attacker registers a DNS name with marshalled target information appended, such as `srv11UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA`. It then coerces the target, for example with PetitPotam. Windows strips the suffix, decides the target is itself, and falls back to local authentication, handing over a SYSTEM token. Microsoft's patch in mrxsmb.sys blocks SMB connections to names that carry marshalled data.

## Who is affected

Windows 10, Windows 11 through 24H2 and Windows Server 2008 SP2 through 2025 before the June 2025 update. Fixed builds include 26100.4349 for Windows 11 24H2 and Server 2025, 22631.5472 for Windows 11 23H2, 19045.5965 for Windows 10 22H2, and 20348.3807 for Server 2022 ([CVE record](https://www.cve.org/CVERecord?id=CVE-2025-33073)). RedTeam says the attack hits domain-joined hosts that do not require SMB signing on incoming connections. By default that covers Windows 10 and 11 up to 23H2 and every Windows Server version except domain controllers.

## Do you really need to act?

Check, and fix signing while you are there. The attacker needs a domain account, a way to add a DNS record, and a coercion method. All three are common inside a network. A patched host is safe. Synacktiv notes that "enforcing SMB signing prevents the exploitation of this vulnerability, even without applying the patch." It also says the patched bug may still be reachable if someone finds an alternative to the DNS record trick. Do not wait for Microsoft's exploited flag to change before patching.

## What to do now

1. Confirm each domain-joined host is at or above its June 2025 build, ideally on the latest cumulative update.
2. Require SMB signing for incoming connections through Group Policy, or with `Set-SmbServerConfiguration -RequireSecuritySignature $true`. Check with `Get-SmbServerConfiguration | Select-Object RequireSecuritySignature`.
3. Test old NAS devices, scanners and appliances before enforcing signing widely.
4. Review who can create records in AD-integrated DNS zones, and reduce coercion paths such as PetitPotam.

## How to tell if you were hit

- Search DNS for the marshalled suffix: `Get-DnsServerResourceRecord -ZoneName corp.example.com | Where-Object HostName -like '*1UWhRCAAAA*'`.
- Review Event ID 5137 for DNS node objects created by ordinary users.
- Look for unexpected Remote Registry service starts and remote SAM reads, which the researchers used after gaining SYSTEM.

## Timeline

- Jan 30, 2025 — RedTeam Pentesting finds the flaw.
- Mar 7, 2025 — Reported to MSRC.
- Jun 10, 2025 — Microsoft ships the fix.
- Jun 11, 2025 — RedTeam and Synacktiv publish details.
- Oct 20, 2025 — CISA adds the CVE to KEV.
- Nov 10, 2025 — Federal remediation deadline.

## Sources

1. [Microsoft — CVE-2025-33073 Windows SMB Client Elevation of Privilege Vulnerability](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-33073)
2. [CVE record — CVE-2025-33073](https://www.cve.org/CVERecord?id=CVE-2025-33073)
3. [NVD — CVE-2025-33073](https://nvd.nist.gov/vuln/detail/CVE-2025-33073)
4. [CISA — Known Exploited Vulnerabilities: CVE-2025-33073](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-33073)
5. [RedTeam Pentesting — Advisory RT-SA-2025-002: Reflective Kerberos Relay Attack](https://www.redteam-pentesting.de/advisories/rt-sa-2025-002/)
6. [RedTeam Pentesting — A Look in the Mirror: The Reflective Kerberos Relay Attack](https://blog.redteam-pentesting.de/2025/reflective-kerberos-relay-attack/)
7. [Synacktiv — NTLM reflection is dead, long live NTLM reflection! An in-depth analysis of CVE-2025-33073](https://www.synacktiv.com/en/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025)
8. [Help Net Security — CISA warns of Windows SMB flaw under active exploitation (CVE-2025-33073)](https://www.helpnetsecurity.com/2025/10/21/cisa-warns-of-windows-smb-flaw-under-active-exploitation-cve-2025-33073/)

---
Source page: https://erroneo.us/security/briefs/windows-smb-client-cve-2025-33073-reflective-relay/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt