CVE-2025-24054: Microsoft Windows NTLM Hash Disclosure Spoofing Vulnerability

What it is

External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.

Exploitation evidence

First exploit evidence seen: 2025-04-17 (earliest date across the sources below).

Exploited in the wild

• CISA KEV: listed since 2025-04-17. Source

Public exploit code

Exploit-DB

• EDB-52280: Microsoft - NTLM Hash Disclosure Spoofing (library-ms) (2025-05-01)
• EDB-52478: windows 10/11 - NTLM Hash Disclosure Spoofing (2026-02-04)
• EDB-52480: Windows 10.0.17763.7009 - spoofing vulnerability (2026-02-11)

GitHub proof-of-concept repositories

10 public repositories from 10 accounts, first seen 2025-04-18. Most starred: helidem/CVE-2025-24054_CVE-2025-24071-PoC (22 stars), view repository.

Verify before running: public PoCs can be malicious. Read the code and only run it in an isolated lab. A PoC means exploit code is public, not that this CVE is exploited in the wild.

Sources: CISA KEV · Exploit-DB (OffSec) · nomi-sec/PoC-in-GitHub.

How to fix it

CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. (source: CISA KEV)

Fixed versions

• microsoft windows 10 1507: upgrade to 10.0.10240.20947 or later
• microsoft windows 10 1607: upgrade to 10.0.14393.7876 or later
• microsoft windows 10 1809: upgrade to 10.0.17763.7009 or later
• microsoft windows 10 21h2: upgrade to 10.0.19044.5608 or later
• microsoft windows 10 22h2: upgrade to 10.0.19045.5608 or later
• microsoft windows 11 22h2: upgrade to 10.0.22621.5039 or later
• microsoft windows 11 23h2: upgrade to 10.0.22631.5039 or later
• microsoft windows 11 24h2: upgrade to 10.0.26100.3403 or later
• microsoft windows server 2016: upgrade to 10.0.14393.7876 or later
• microsoft windows server 2019: upgrade to 10.0.17763.7009 or later
• microsoft windows server 2022: upgrade to 10.0.20348.3270 or later
• microsoft windows server 2022 23h2: upgrade to 10.0.25398.1486 or later
• microsoft windows server 2025: upgrade to 10.0.26100.3403 or later

Derived from the NVD CPE configuration (versionEndExcluding / versionEndIncluding). Always confirm with the vendor advisory.

Vendor advisories and patches

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24054 (CISA KEV notes)
• https://www.vicarius.io/vsociety/posts/cve-2025-24054-spoofing-vulnerability-in-windows-ntlm-by-microsoft-mitigation-script (Mitigation, Third Party Advisory)

MITRE ATT&CK mitigations for this chain

• M1047 Audit (for T1566) : Perform audits or scans of systems, permissions, insecure software, insecure configurations, etc. to identify potential weaknesses.
• M1031 Network Intrusion Prevention (for T1566) : Network intrusion prevention systems and systems designed to scan and remove malicious email attachments or links can be used to block activity.
• M1054 Software Configuration (for T1566) : Use anti-spoofing and email authentication mechanisms to filter messages based on validity checks of the sender domain (using SPF) and integrity of messages (using DKIM). Enabling these mechanisms within an organization (through policies such as DMARC) may enable recipients (intra-org and cross domain) to perform simil
• M1021 Restrict Web-Based Content (for T1566) : Determine if certain websites or attachment types (ex: .scr, .exe, .pif, .cpl, etc.) that can be used for phishing are necessary for business operations and consider blocking access if activity cannot be monitored well or if it poses a significant risk.
• M1049 Antivirus/Antimalware (for T1566) : Anti-virus can automatically quarantine suspicious files.
• M1017 User Training (for T1566) : Users can be trained to identify social engineering techniques and phishing emails.
• M1026 Privileged Account Management (for T1555) : Limit the number of accounts and services with permission to query information from password stores to only those required. Ensure that accounts and services with permissions to query password stores only have access to the secrets they require.
• M1051 Update Software (for T1555) : Perform regular software updates to mitigate exploitation risk.
• M1027 Password Policies (for T1555) : The password for the user's login keychain can be changed from the user's login password. This increases the complexity for an adversary because they need to know an additional password. Organizations may consider weighing the risk of storing credentials in password stores and web browsers. If system, software, or web

Detection Generic guidance

• Initial Access: Alert on unusual requests to the affected service (odd paths, oversized payloads, exploit strings) in WAF, reverse-proxy and application logs.
• Credential Access: Monitor for credential dumping, unusual LSASS access and sudden authentication from new sources.

Response checklist Generic guidance

1. Inventory: find every instance of the affected product and version (include internet-facing and forgotten ones).
2. Patch or mitigate per the vendor advisory; if you cannot patch, remove internet exposure or apply the vendor workaround.
3. Assume compromise if the system was exposed before patching: hunt for the indicators in the advisory and review logs back to the disclosure date.
4. Rotate credentials and secrets stored on or used by the affected system if compromise cannot be ruled out.