CVE-2025-24054: Windows NTLM file path control allows spoofing

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is in CISA KEV with public exploits and very high EPSS, though the CVSS score is only medium and user interaction is required.

What it is

Windows NTLM mishandles externally controlled file names or paths, letting an unauthorized attacker perform spoofing over a network. The flaw affects a broad set of Windows client and server releases, and it has been added to CISA's Known Exploited Vulnerabilities catalog, so it is being used in the wild.

Impact

An attacker can spoof NTLM authentication and disclose NTLM hashes, which can be relayed or cracked to gain access to other systems. The CVSS impact is limited to confidentiality and integrity, with no availability impact.

Attack surface

Reachable over the network (AV:N) with no privileges required (PR:N), but exploitation requires user interaction (UI:R), typically opening or handling a crafted file or path. No authentication is needed on the attacker's side.

Exploitation

Listed in CISA KEV since 2025-04-17 with a 2025-05-08 remediation due date, and public exploit code exists in Exploit-DB and third-party posts. EPSS is 0.589 (99th percentile), indicating high predicted exploitation activity.

What to do

• Apply the Microsoft security update for CVE-2025-24054 across all affected Windows client and server versions.
• Follow CISA BOD 22-01 guidance and meet the 2025-05-08 remediation deadline.
• Disable or restrict NTLM where possible and enforce SMB signing to block relay attacks.
• Block outbound SMB and NTLM traffic at network boundaries to limit hash exfiltration.
• Treat untrusted files and paths with caution and restrict user ability to open externally supplied content.

Detection

• Monitor for NTLM authentication attempts to unexpected or external hosts, especially SMB and HTTP NTLM negotiation.
• Alert on outbound SMB (445) and NTLM traffic from workstations to internet or untrusted networks.
• Hunt for processes opening files from untrusted paths or network shares that trigger NTLM authentication.
• Review Windows event logs for anomalous NTLM logon and authentication patterns tied to file access.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.