CriticalCVE-2025-24054

NTLM Hash Disclosure Spoofing Vulnerability (CVE-2025-24054)

Published 11.03.2025In CISA KEV since 17.04.2025Sources: CVE.org, pwn.watch, Msrc Update Guide

What is affected, what to do

External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.

The vulnerability is being actively exploited; treat it as a priority. Update Microsoft Windows 10 Version 1507 to version 10.0.10240.20947, Microsoft Windows 10 Version 1607 to version 10.0.14393.7876, Microsoft Windows 10 Version 1809 to version 10.0.17763.7009. Immediate actions, mitigation and detection rules are in the runbook below.

Affected: Microsoft Windows 10 Version 1507 lt 10.0.10240.0..10.0.10240.20947
Microsoft Windows 10 Version 1607 lt 10.0.14393.0..10.0.14393.7876
Microsoft Windows 10 Version 1809 lt 10.0.17763.0..10.0.17763.7009
Microsoft Windows 10 Version 21H2 lt 10.0.19044.0..10.0.19044.5608
Microsoft Windows 10 Version 22H2 lt 10.0.19045.0..10.0.19045.5608
Microsoft Windows 11 version 22H2 lt 10.0.22621.0..10.0.22621.5039
Microsoft Windows 11 version 22H3 lt 10.0.22631.0..10.0.22631.5039
Microsoft Windows 11 Version 23H2 lt 10.0.22631.0..10.0.22631.5039
Microsoft Windows 11 Version 24H2 lt 10.0.26100.0..10.0.26100.3476
Microsoft Windows Server 2008 R2 Service Pack 1 lt 6.1.7601.0..6.1.7601.27618
Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation) lt 6.1.7601.0..6.1.7601.27618
Microsoft Windows Server 2012 lt 6.2.9200.0..6.2.9200.25368
Microsoft Windows Server 2012 (Server Core installation) lt 6.2.9200.0..6.2.9200.25368
Microsoft Windows Server 2012 R2 lt 6.3.9600.0..6.3.9600.22470
Microsoft Windows Server 2012 R2 (Server Core installation) lt 6.3.9600.0..6.3.9600.22470
Microsoft Windows Server 2016 lt 10.0.14393.0..10.0.14393.7876
Microsoft Windows Server 2016 (Server Core installation) lt 10.0.14393.0..10.0.14393.7876
Microsoft Windows Server 2019 lt 10.0.17763.0..10.0.17763.7009
Microsoft Windows Server 2019 (Server Core installation) lt 10.0.17763.0..10.0.17763.7009
Microsoft Windows Server 2022 lt 10.0.20348.0..10.0.20348.3328
Microsoft Windows Server 2022, 23H2 Edition (Server Core installation) lt 10.0.25398.0..10.0.25398.1486
Microsoft Windows Server 2025 lt 10.0.26100.0..10.0.26100.3476
Microsoft Windows Server 2025 (Server Core installation) lt 10.0.26100.0..10.0.26100.3476
Fixed in: Microsoft Windows 10 Version 1507 10.0.10240.20947
Microsoft Windows 10 Version 1607 10.0.14393.7876
Microsoft Windows 10 Version 1809 10.0.17763.7009
Microsoft Windows 10 Version 21H2 10.0.19044.5608
Microsoft Windows 10 Version 22H2 10.0.19045.5608
Microsoft Windows 11 version 22H2 10.0.22621.5039
Microsoft Windows 11 version 22H3 10.0.22631.5039
Microsoft Windows 11 Version 23H2 10.0.22631.5039
Microsoft Windows 11 Version 24H2 10.0.26100.3476
Microsoft Windows Server 2008 R2 Service Pack 1 6.1.7601.27618
Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation) 6.1.7601.27618
Microsoft Windows Server 2012 6.2.9200.25368
Microsoft Windows Server 2012 (Server Core installation) 6.2.9200.25368
Microsoft Windows Server 2012 R2 6.3.9600.22470
Microsoft Windows Server 2012 R2 (Server Core installation) 6.3.9600.22470
Microsoft Windows Server 2016 10.0.14393.7876
Microsoft Windows Server 2016 (Server Core installation) 10.0.14393.7876
Microsoft Windows Server 2019 10.0.17763.7009
Microsoft Windows Server 2019 (Server Core installation) 10.0.17763.7009
Microsoft Windows Server 2022 10.0.20348.3328
Microsoft Windows Server 2022, 23H2 Edition (Server Core installation) 10.0.25398.1486
Microsoft Windows Server 2025 10.0.26100.3476
Microsoft Windows Server 2025 (Server Core installation) 10.0.26100.3476

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

6.5

Priority

XIEM Effective CVSS: highest available CVSS rating from NVD and vendor data.

Source: Vendor (CNA), CVSS v3

6.5

CVSS v3

Severity Medium on the scale from 0 to 10.

Source: CVE.org, pwn.watch, Msrc Update Guide

62.3 %

EPSS score

High — model estimates ≥ 50% chance of real-world exploitation within 30 days.

Source: FIRST EPSS, percentile 99.18

Show all metrics

Severity: Critical
Priority (0–325) The priority score is a consolidated metric that condenses several individual signals into a single, action-guiding ranking: technical severity (CVSS), exploitation likelihood (EPSS), known-exploited status (KEV) and the context of the affected asset. The aim is to answer the only truly important question in vulnerability management: what first? Read in glossary: 219.41 Methodology
Exploit maturity An exploit is code or a technique that specifically uses a concrete vulnerability to force unintended behaviour — such as executing code or escalating privileges. It is the tool that turns a theoretical flaw into a practical attack. Read in glossary: actively exploitedSource: VulnCheck KEV (opens in a new tab) How we classify
XIEM Effective CVSS XIEM® is the tiered managed-security operating model from NEOSEC and a registered trademark of NEOSEC GmbH. It extends classic SIEM — the central collection, normalisation and correlation of security-relevant events — with endpoint forensics, network visibility and deception technology, and consolidates them into three building tiers: Sentry, Orchestrate and Command. Read in glossary: 6.5 Methodology
CVSS v3 CVSS is the globally established, open standard for assessing the technical severity of a vulnerability on a scale from 0 to 10. It describes how easily a flaw can be exploited and what damage it can cause — but not how likely its actual exploitation is. CVSS and the complementary EPSS deliberately answer different questions. Read in glossary: 6.5
EPSS score The EPSS score is the absolute model output for an individual vulnerability: the estimated probability of real-world exploitation within the next 30 days, expressed as a value between 0 and 1 (i.e. 0 % to 100 %). A score of 0.42 means „the model estimates a 42 % chance of real-world exploitation within 30 days“. Read in glossary: 62.3 %; High — model estimates ≥ 50% chance of real-world exploitation within 30 days.
EPSS percentile The EPSS percentile is the relative position of a vulnerability within all EPSS-scored CVEs, expressed as a value between 0 and 1. A percentile of 0.90 means „this CVE has a higher EPSS score than 90 % of all other scored CVEs“. Unlike the EPSS score, it is not a probability — but a positioning within a ranking. Read in glossary: 99.18; Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
KEV status The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching. Read in glossary: Actively exploited
Published: 11.03.2025
In CISA KEV since The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching. Read in glossary: 17.04.2025
CWE CWE is a catalogue of typical weakness types in software and hardware — such as flawed input validation, unsafe memory handling or poor authentication. Where a CVE names a concrete vulnerability in a concrete product, a CWE describes the underlying class of defect. Read in glossary: CWE-73

Response and mitigation

Why act now?

Prioritisation rationale

The flaw is reachable over the network without authentication and needs only minimal user interaction. A crafted .library-ms file inside an archive is enough to make Windows authenticate via NTLM to an attacker-controlled server. The standalone impact looks moderate, but the leaked hash enables offline cracking and NTLM relay. That in turn enables lateral movement and potentially full domain compromise. Exploitation likelihood is among the very highest of all CVEs, and phishing campaigns weaponised it shortly after the patch shipped. CISA does not flag known ransomware use. Organisations with a large Windows client estate, permitted outbound SMB, or missing SMB/LDAP signing should treat this as high urgency and close it fully within the current patch cycle.

01
Runbook step 1
Immediate response (0-24 h)
- Deploy the March 2025 Microsoft security update to all Windows clients. Minimum builds per the context are:
  
  Windows 10 1507 → 10.0.10240.20947
  
  Windows 10 1607 → 10.0.14393.7876
  
  Windows 10 1809 → 10.0.17763.7009
  
  Windows 10 21H2/22H2 → 10.0.19044.5608 / 10.0.19045.5608
  
  Windows 11 22H2 → 10.0.22621.5039
  
  Windows 11 22H3/23H2 → 10.0.22631.5039
  
  Look up KB numbers and affected Server editions in the vendor advisory.
- Query patch compliance from inventory (Intune, SCCM, or Get-ComputerInfo | select OsBuildNumber,OsVersion). Flag any host below these builds as exposed.
- Block outbound SMB (TCP 445/139) to the internet at the perimeter firewall now if not already done. This cuts the hash-leak path to external attacker servers.
- Block or quarantine attachments and archives (ZIP/RAR) containing .library-ms or .searchConnector-ms files at the mail gateway and web proxy. Exploitation needs only minimal user interaction, such as extracting the archive or viewing it in Explorer.
- Retro-hunt mailboxes over the past weeks for such attachments. For users with hits, reset passwords, revoke active sessions, and check for NTLM relay follow-on activity.
02
Runbook step 2
Mitigation layers
- Network segmentation: Allow SMB only to designated file servers and domain controllers, and block client-to-client SMB via a Windows Firewall GPO. Restrict the WebDAV fallback over HTTP/80 and 443 to unknown destinations at the proxy.
- Endpoint hardening: Disable the WebClient service where WebDAV is not needed, which removes the HTTP-based leak path. Add an ASR or AppLocker rule against execution from archive temp paths.
- NTLM restriction (configuration): Set the GPO "Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers" to "Audit all" first. After review, move to "Deny all" with an exception list of internal servers.
- IAM / least privilege: Put privileged accounts in the "Protected Users" group (Kerberos only, no NTLM). Admin accounts must never be used for mail or web browsing.
- Relay protection: Enforce SMB signing, LDAP signing and channel binding, and Extended Protection for Authentication on AD CS and IIS. This makes a captured hash useless for relay attacks.
- Password policy: Enforce long passphrases, because stolen NetNTLMv2 hashes will be cracked offline.
03
Runbook step 3
Detection rules
- Sysmon EID 11 (FileCreate): Creation of *.library-ms or *.searchConnector-ms files under \Downloads\, \AppData\Local\Temp\ or Outlook cache paths. Sigma shape: TargetFilename|endswith: ['.library-ms','.searchConnector-ms'].
- Sysmon EID 3 / EDR network event: explorer.exe connecting to a public IP on port 445. KQL: DeviceNetworkEvents | where InitiatingProcessFileName =~ "explorer.exe" and RemotePort == 445 and RemoteIPType == "Public"
- NTLM audit (Microsoft-Windows-NTLM/Operational, EID 8001): Outbound NTLM authentication to servers not on the internal allowlist, especially right after an archive extraction.
- Firewall, Zeek or Suricata telemetry: Outbound TCP 445 sessions to the internet, and Zeek ntlm.log or smb_mapping.log entries with external destinations. Blocked attempts still indicate successful delivery.
- Mail logs: Attachment names or archive contents matching .library-ms. Correlate these with the recipient, the open time, and subsequent NTLM network logons (EID 4624, Logon Type 3) from unusual sources.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2 NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management. Read in glossary: Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).
CRA The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates. Read in glossary: Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.
ISO/IEC 27001 ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security. Read in glossary: Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.

Source: cvelistv5, pwn.watch, NVD (NIST), Microsoft Security Update Guide, CISA KEV Catalog, CVE.org (MITRE)

Affected products

The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

Affected products
		Affected versions	Fixed in
Microsoft	Windows 10 Version 1507	`10.0.10240.0 – < 10.0.10240.20947`	`10.0.10240.20947`
Microsoft	Windows 10 Version 1607	`10.0.14393.0 – < 10.0.14393.7876`	`10.0.14393.7876`
Microsoft	Windows 10 Version 1809	`10.0.17763.0 – < 10.0.17763.7009`	`10.0.17763.7009`
Microsoft	Windows 10 Version 21H2	`10.0.19044.0 – < 10.0.19044.5608`	`10.0.19044.5608`
Microsoft	Windows 10 Version 22H2	`10.0.19045.0 – < 10.0.19045.5608`	`10.0.19045.5608`
Microsoft	Windows 11 version 22H2	`10.0.22621.0 – < 10.0.22621.5039`	`10.0.22621.5039`
Microsoft	Windows 11 version 22H3	`10.0.22631.0 – < 10.0.22631.5039`	`10.0.22631.5039`
Microsoft	Windows 11 Version 23H2	`10.0.22631.0 – < 10.0.22631.5039`	`10.0.22631.5039`
Microsoft	Windows 11 Version 24H2	`10.0.26100.0 – < 10.0.26100.3476`	`10.0.26100.3476`
Microsoft	Windows Server 2008 R2 Service Pack 1	`6.1.7601.0 – < 6.1.7601.27618`	`6.1.7601.27618`
Microsoft	Windows Server 2008 R2 Service Pack 1 (Server Core installation)	`6.1.7601.0 – < 6.1.7601.27618`	`6.1.7601.27618`
Microsoft	Windows Server 2012	`6.2.9200.0 – < 6.2.9200.25368`	`6.2.9200.25368`
Microsoft	Windows Server 2012 (Server Core installation)	`6.2.9200.0 – < 6.2.9200.25368`	`6.2.9200.25368`
Microsoft	Windows Server 2012 R2	`6.3.9600.0 – < 6.3.9600.22470`	`6.3.9600.22470`
Microsoft	Windows Server 2012 R2 (Server Core installation)	`6.3.9600.0 – < 6.3.9600.22470`	`6.3.9600.22470`
Microsoft	Windows Server 2016	`10.0.14393.0 – < 10.0.14393.7876`	`10.0.14393.7876`
Microsoft	Windows Server 2016 (Server Core installation)	`10.0.14393.0 – < 10.0.14393.7876`	`10.0.14393.7876`
Microsoft	Windows Server 2019	`10.0.17763.0 – < 10.0.17763.7009`	`10.0.17763.7009`
Microsoft	Windows Server 2019 (Server Core installation)	`10.0.17763.0 – < 10.0.17763.7009`	`10.0.17763.7009`
Microsoft	Windows Server 2022	`10.0.20348.0 – < 10.0.20348.3328`	`10.0.20348.3328`
Microsoft	Windows Server 2022, 23H2 Edition (Server Core installation)	`10.0.25398.0 – < 10.0.25398.1486`	`10.0.25398.1486`
Microsoft	Windows Server 2025	`10.0.26100.0 – < 10.0.26100.3476`	`10.0.26100.3476`
Microsoft	Windows Server 2025 (Server Core installation)	`10.0.26100.0 – < 10.0.26100.3476`	`10.0.26100.3476`

Vendors and products

Affected operating systems

Affected operating systems

Windows	microsoft	windows_10_1507	—
Windows	microsoft	windows_10_1607	—
Windows	microsoft	windows_10_1809	—
Windows	microsoft	windows_10_21h2	—
Windows	microsoft	windows_10_22h2	—
Windows	microsoft	windows_11_22h2	—
Windows	microsoft	windows_11_23h2	—
Windows	microsoft	windows_11_24h2	—
Windows	microsoft	windows_server_2008	`r2`
Windows	microsoft	windows_server_2012	`r2`
Windows	microsoft	windows_server_2012	—
Windows	microsoft	windows_server_2016	—
Windows	microsoft	windows_server_2019	—
Windows	microsoft	windows_server_2022	—
Windows	microsoft	windows_server_2022_23h2	—
Windows	microsoft	windows_server_2025	—

Weakness classes (CWE)

CWE-73External Control of File Name or Path
Base
The product allows user input to control or influence paths or file names that are used in filesystem operations.
Entry at MITRE CWE-73

Public exploit references

Publicly reported proof-of-concepts, exploit modules and detection templates for this vulnerability. NEOSEC links to the original sources only and does not provide any exploit code.

Public exploit references

CISA KEV Catalog	CISA Known Exploited Vulnerability (opens in a new tab)cisa.gov	actively exploited	17.04.2025
Exploit-DB	EDB-ID 52478 (opens in a new tab)exploit-db.com	PoC (publicly reported)reported, not verified	—
Exploit-DB	EDB-ID 52480 (opens in a new tab)exploit-db.com	PoC (publicly reported)reported, not verified	—
PoC-in-GitHub (nomi-sec)	cve-2025-24054-lab (opens in a new tab)github.com	PoC (publicly reported)reported, not verified	01.07.2026
PoC-in-GitHub (nomi-sec)	cve-2025-24054 (opens in a new tab)github.com	PoC (publicly reported)reported, not verified	21.06.2026

References & sources

Microsoft Security Update GuideNTLM Hash Disclosure Spoofing VulnerabilityVendor advisory, Patch, Vendor advisory, pwn-watch
cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24054government-resource, US government resource
seclists.orgfulldisclosure/2025/Apr/28Mailing list
vicarius.iovsociety/posts/cve-2025-24054-spoofing-vulnerability-in-windows…Exploit, Third-party advisory
vicarius.iovsociety/posts/cve-2025-24054-spoofing-vulnerability-in-windows…Mitigation, Third-party advisory
exploit-db.comexploits/52478Exploit, Third-party advisory, Vulnerability database
exploit-db.comexploits/52480Exploit, Third-party advisory, Vulnerability database
pwn.watchpwn.watch: Microsoft Windows: Windows NTLM Hash Disclosure Spoofing Vulnerabilitypwn-watch
NVD (NIST)NVD: CVE-2025-24054pwn-watch
cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch

Embed badge

Show the severity and KEV status of this vulnerability on your site – with a link back here. The image is updated hourly.

<a href="https://intel.neosec.eu/en/cve/CVE-2025-24054"><img src="https://intel.neosec.eu/badge/cve/CVE-2025-24054.svg?lang=en" alt="CVE-2025-24054 – NEOSEC Intel" height="20"></a>

What is affected, what to do

Metrics

Response and mitigation

Prioritisation rationale

Immediate response (0-24 h)

Mitigation layers

Detection rules

Detection rules

Classification under NIS2 and CRA

Description

Affected products

Vendors and products

Affected operating systems

Weakness classes (CWE)

Public exploit references

References & sources