Windows NTLM spoofing via file path control leaks credential hashes
Windows NTLM spoofing via external file path control lets a network attacker capture NTLM credential hashes without user interaction beyond browsing to a folder. CVSS 6.5. Patched March 2025.
- Vendor
- Microsoft
- Product
- Windows NTLM
- CVSS
- 6.5
- EPSS (exploit probability)
- 62.3%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Published
Is CVE-2025-24054 being exploited?
Yes. CISA added CVE-2025-24054 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 62.3% (scored October 14, 2026).
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-13. Full cross-catalog view: /kev-comparison
CVE-2025-24054 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
What to do
US federal civilian agencies must remediate by (21 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.
External control of file name or path in Windows NTLM (CWE-73) enables spoofing and credential-hash disclosure over a network. A victim browsing to a folder containing a crafted .library-ms or shortcut file triggers an automatic NTLM authentication attempt — no click required, no obvious user interaction. The resulting NTLMv2 hash can be captured with a relay or relay-to-crack pipeline.
Context
The CVSS 6.5 score reflects that an attacker still needs a path to deliver the crafted file — but that’s a lower bar than it sounds. Network shares, WebDAV, phishing lures pointing to a UNC path, and even embedded shortcuts in archive files all work. Rapid7 observed a threat actor QA’ing this CVE alongside CVE-2025-33053 and CVE-2026-21513 in a delivery lab aimed at Mexican targets. The operator was testing search-ms: URI delivery and double-extension spoofing, both realistic file-delivery vectors.
NTLM hash captures feed directly into pass-the-hash, relay, and offline cracking pipelines. Medium CVSS score, but frequently the opening step in a longer chain.
What to do
- Apply the March 2025 Patch Tuesday update. The fix is shipping since March 11, 2025.
- Enforce Extended Protection for Authentication (EPA) on all services accepting NTLM. Relay attacks against unprotected endpoints are the most common next step.
- Consider blocking NTLM outbound at the perimeter. If you can enforce Kerberos in your environment, NTLM-based hash captures lose their value.
- Block
search-ms:URI handler abuse. Registry or GPO can disable thesearch-ms:protocol handler — it has limited legitimate use and broad phishing history.
Sources
- NVD CVE-2025-24054
- Rapid7 threat research: exposed WebDAV malware lab (via our coverage)
Other Microsoft CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-124194 Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability | [ MEDIUM ] | 6.5 | 1.6% | |
| CVE-2026-96951 Microsoft Windows Command Injection Vulnerability | [ HIGH ] | 8.8 | 9.8% | |
| CVE-2026-96940 Microsoft Exchange Server privilege escalation via weak authorizationwrite-up | [ HIGH ] | 8.8 | 2.7% | — |
| CVE-2026-65660 Microsoft SharePoint Code Injection Vulnerabilitywrite-up | [ HIGH ] | 8.8 | 9.9% | |
| CVE-2026-85889 Azure AI Foundry missing authentication allows unauthorized privilege escalationwrite-up | [ CRITICAL ] | 10.0 | 0.7% | — |
| CVE-2026-69843 Microsoft Fabric authentication bypass by spoofingwrite-up | [ CRITICAL ] | 10.0 | 0.9% | — |
| CVE-2026-85880 Microsoft Windows ALPC Heap Buffer Overflow Privilege Escalationwrite-up | [ HIGH ] | 7.8 | 0.4% | |
| CVE-2026-81963 Microsoft Windows Update Stack Link-Following Privilege Escalationwrite-up | [ HIGH ] | 7.8 | 7.1% |
