CVE-2025-33053: Microsoft Windows WebDAV Internet Shortcut File Path Control RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityIt is a network-reachable remote code execution flaw that is listed in CISA KEV as exploited in the wild, with a very high EPSS score and a broad Windows product footprint.

What it is

Windows Internet Shortcut (.url) files allow external control of a file name or path, which an unauthorized attacker can abuse to execute code over a network. The flaw is in how Windows handles WebDAV paths referenced by shortcut files, and it affects a broad range of Windows client and server releases. Because it is a zero-day that has been exploited in the wild and is listed in CISA KEV, it is a high-priority patching target.

Impact

An attacker can achieve remote code execution with high confidentiality, integrity and availability impact on the victim host. Successful exploitation gives the attacker code execution in the context of the user who opened the crafted shortcut.

Attack surface

Reached over the network via a crafted Internet Shortcut file that triggers a WebDAV path, requiring user interaction (UI:R) to open the file; no authentication is required (PR:N). The CVSS vector is AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2025-06-10 with a remediation due date of 2025-07-01, and references include exploit and technical description tags. EPSS is 0.87607 (99.749th percentile), indicating very high predicted exploitation activity.

What to do

• Apply the Microsoft security update for CVE-2025-33053 to all affected Windows client and server versions as soon as possible.
• Follow CISA KEV required action and BOD 22-01 guidance, prioritizing internet-facing and high-value systems before the 2025-07-01 due date.
• Disable or restrict WebDAV client functionality where it is not required, and block outbound WebDAV traffic to untrusted hosts.
• Harden email and web gateways to block or quarantine .url and Internet Shortcut attachments and downloads from untrusted sources.
• If patching is not immediately possible, apply vendor mitigations or discontinue use of the affected product per CISA guidance.

Detection

• Monitor for creation or opening of .url files that reference remote WebDAV paths, especially from email attachments or downloads.
• Alert on unusual child processes spawned by explorer.exe or rundll32.exe following access to .url files.
• Hunt for outbound WebDAV (HTTP/HTTPS) connections to untrusted or newly observed hosts from user workstations.
• Review endpoint logs for file path manipulation events involving Internet Shortcut files and WebDAV UNC paths.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.