CISA Warns of Actively Exploited Windows SMB Vulnerability

According to CISA’s advisory, the Cybersecurity and Infrastructure Security Agency has added a critical Microsoft Windows Server Message Block (SMB) vulnerability to its Known Exploited Vulnerabilities catalog, with threat actors actively exploiting the flaw in the wild. The vulnerability, tracked as CVE-2025-33073, affects the Windows SMB Client and could allow attackers to escalate privileges on compromised systems.

It is an improper access control vulnerability, and the attack can involve a specially crafted scenario that coerces a victim machine into connecting back to an attacker-controlled system using the SMB protocol and authenticating against it. CISA notes that CVE-2025-33073 has been added to its catalog on 20 October 2025, signalling an immediate threat to federal networks and critical infrastructure.

Federal Civilian Executive Branch agencies must apply mitigations or discontinue use by 10 November 2025, under Binding Operational Directive 22-01, with organisations urged to prioritise remediation of listed flaws in vulnerability management programmes. Security teams should monitor for suspicious SMB authentication attempts and unusual network connections that could indicate exploitation.