Windows NTLM File Path Control Spoofing Vulnerability (CVE-2025-24054) Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTActive Directory environments and Windows operating systems utilizing the NTLM authentication protocol
Unauthorized remote attackers can control file names or paths to perform network-based spoofing and credential relay attacks
Apply the latest Microsoft cumulative security updates and restrict NTLM authentication traffic
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Apply the latest cumulative updates provided by Microsoft. You can force Windows Update via PowerShell to ensure the patch is applied immediately.
# Install Windows Update module and apply all pending security patches
Install-Module PSWindowsUpdate -Force -Verbose
Get-WindowsUpdate -AcceptAll -Install -AutoReboot2. Temporary Workaround & Hardening Configuration
If immediate patching is not feasible, restrict outgoing NTLM traffic and enforce SMB signing to mitigate potential relay and spoofing vectors.
# Restrict outgoing NTLM traffic via Registry
New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0' -Name 'RestrictSendingNTLMTraffic' -PropertyType DWord -Value 2 -Force
# Enforce SMB Server Security Signatures
Set-SmbServerConfiguration -RequireSecuritySignature $true -Force3. Log Audit & IoC Verification Commands
Monitor NTLM operational logs to detect unauthorized authentication attempts or spoofing activities.
# Query NTLM Operational event logs for auditing and restriction events
Get-WinEvent -LogName 'Microsoft-Windows-NTLM/Operational' -ErrorAction SilentlyContinue | Where-Object { $_.Id -match '800[1-4]' } | Select-Object TimeCreated, Id, Message | Out-StringBlock Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot
Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2025-24054) is an external control of file name or path vulnerability (CWE-73) residing within the Windows NTLM authentication mechanism. Due to insufficient validation of input file paths during NTLM authentication processing, an attacker can manipulate the path to force the system to interact with arbitrary network locations.
2. Exploitation Mechanics & Attack Scenario
An unauthenticated network attacker can exploit this vulnerability by enticing a user to interact with a malicious link or processing a crafted network request. When the NTLM handler processes the untrusted file path, it initiates an authentication handshake towards an attacker-controlled server (e.g., running Responder). This allows the attacker to capture or relay NTLM credentials, leading to potential domain compromise.
3. Infrastructure & Business Impact
This vulnerability is actively exploited in the wild and is listed on the CISA KEV catalog with a high EPSS score of over 0.62. Successful exploitation poses a severe threat to enterprise Active Directory infrastructures, potentially allowing lateral movement, privilege escalation, and full domain takeover.
Official Vendor Advisories & References
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.
Frequently Asked SecOps Questions (CVE-2025-24054)
FAQQ1. How critical is CVE-2025-24054 and is it actively exploited in the wild?
CVE-2025-24054 is rated CVSS 5.4 (MEDIUM) with a 30-day EPSS exploitation probability of 62.3%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2025-24054?
Primary impacted vendors include microsoft across windows, ntlm. Scope summary: All supported versions of Windows and Windows Server utilizing NTLM authentication
Q3. What temporary mitigations or workarounds exist for CVE-2025-24054 before patching?
[Mitigation] Apply the latest Microsoft cumulative security updates and restrict NTLM authentication traffic Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2025-24054
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (microsoft)
View Category →Microsoft Windows Shell Security Feature Bypass Vulnerability (CVE-2026-21510) Urgent Security Advisory
[Affected Scope] Windows Shell component across Microsoft Windows operating systems
Windows ALPC Heap-Based Buffer Overflow Privilege Escalation Vulnerability (CVE-2026-85880) Security Advisory
[Affected Scope] Locally authenticated users across Microsoft Windows operating systems
Windows Update Stack Privilege Escalation Vulnerability via Link Following (CVE-2026-81963) Technical Advisory
[Affected Scope] Microsoft Windows operating systems utilizing the Windows Update Stack
Windows AFD.sys Use-After-Free Local Privilege Escalation Vulnerability (CVE-2026-68820) Security Advisory
[Affected Scope] Systems running Microsoft Windows operating systems utilizing the Ancillary Function Driver for WinSock (afd.sys)
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.