CVE-2021-28325: Windows SMB information disclosure flaw

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

medium priorityCVSS rates it medium (6.5) and it is not in KEV, but the high EPSS score and the ubiquity of SMB keep it worth prompt patching.

What it is

CVE-2021-28325 is an information disclosure vulnerability in Windows SMB, affecting Windows 10, Windows 8.1, Windows RT 8.1, and Windows Server 2012, 2016 and 2019. The record gives only a one-line description and no root-cause detail, so the exact mechanism is unknown, but the flaw matters because SMB is a core, widely exposed Windows service.

Impact

An attacker who can reach SMB can read information they are not authorized to see; the CVSS vector rates confidentiality impact as high with no integrity or availability effect. The specific data exposed is not stated in the record.

Attack surface

Reachable over the network via SMB (AV:N) with low attack complexity and no user interaction; the vector requires low privileges (PR:L), so the attacker needs some valid account or foothold rather than being fully unauthenticated.

Exploitation

Not listed in CISA KEV and no ransomware use is documented, but EPSS is high at 0.62 (99th percentile), indicating elevated predicted exploitation activity. The only references are Microsoft patch advisories, so no public exploit or in-the-wild confirmation is provided.

What to do

• Apply the Microsoft security update for CVE-2021-28325 on all affected Windows versions as the first action.
• Restrict SMB exposure: block TCP 445 and 139 at network boundaries and segment hosts that do not need SMB.
• Enforce least privilege and remove unnecessary local or domain accounts that could satisfy the low-privilege requirement.
• Disable SMBv1 and legacy SMB features where they are not required, and monitor for unauthorized SMB configuration changes.

Detection

• Monitor SMB traffic and authentication logs for unusual read or enumeration activity from low-privileged accounts.
• Alert on anomalous SMB connections to file shares or IPC$ from hosts that do not normally use SMB.
• Correlate SMB access events with post-exploitation behavior such as credential access or lateral movement attempts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.