CYBERSIXT Signal Over Noise
All CVEs
Vulnerability intelligence

CVE-2025-33073

Microsoft Windows SMB Client Improper Access Control Vulnerability

Microsoft Windows CWE-284

Improper access control in Windows SMB allows an authorized attacker to elevate privileges over a network.

CVSS Score
8.8
High
EPSS — Exploit Probability
65%
Riskier than 99% of all CVEs
Exploitation
Confirmed in the wild
Used in ransomware campaigns
Remediation
Patch available
Federal deadline 2025-11-10
CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Deadline for federal agencies: 2025-11-10.

NVD entry Vendor patch PoC / advisory CISA KEV

1 article across 1 outlet · first covered May 13, 2026 · latest May 13, 2026

Tracked incidents

incident closed 2 articles
Gentlemen RaaS internal database leak exposes member accounts and chats

Associated threat actors

The Gentlemen

Coverage timeline

Related CVEs — Microsoft

CVE-2026-45659KEV CVE-2026-33825KEV CVE-2026-42897KEV CVE-2026-41091KEV CVE-2008-4250KEV CVE-2009-1537KEV CVE-2010-0249KEV CVE-2010-0806KEV