{"id":"CVE-2025-33053","published":"2025-06-10T17:22:18Z","modified":"2026-06-17T09:13:01Z","title":"Microsoft Windows External Control of File Name or Path Vulnerability","vendor":"Microsoft","product":"Windows","tier":"core","eol":null,"description":{"text":"External control of file name or path in Internet Shortcut Files allows an unauthorized attacker to execute code over a network.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is an external control of file name or path weakness in the Internet Shortcut File handling of Microsoft Windows, which lets input influence the file name or path used. An unauthorized attacker can exploit it over a network to execute code, and this requires user interaction on the victim's side.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:10:15Z"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.87015,"percentile":0.99746,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2025-06-10","dueDate":"2025-07-01","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-33053 ; https://nvd.nist.gov/vuln/detail/CVE-2025-33053","provenance":"source"},"vulncheckKev":{"dateAdded":"2025-06-10","exploitedFirstSeen":"2025-06-10","ransomware":false,"evidence":[{"url":"https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2025-Jun","date":"2025-06-10"},{"url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","date":"2025-06-10"},{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-33053","date":"2025-06-10"},{"url":"https://research.checkpoint.com/2025/stealth-falcon-zero-day/","date":"2025-06-10"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-06-10"},{"url":"https://cyble.com/blog/week-in-vulnerabilities-ivanti-flagged-by-cyble/","date":"2025-06-13"},{"url":"https://infosecwriteups.com/cve-2025-33053-new-0-day-in-webdav-exposes-servers-to-remote-code-execution-heres-what-you-e12787fa559a","date":"2025-06-13"},{"url":"https://medium.com/@nshcthreatrecon/monthly-threat-actor-group-intelligence-report-june-2025-3491df82965b","date":"2025-07-18"},{"url":"https://securelist.com/vulnerabilities-and-exploits-in-q2-2025/117333/","date":"2025-08-27"},{"url":"https://ics-cert.kaspersky.com/publications/reports/2025/09/04/apt-and-financial-attacks-on-industrial-organizations-in-q2-2025/","date":"2025-09-04"}],"evidenceTotal":17,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-73","name":"External Control of File Name or Path"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-33053","tags":["Vendor Advisory"]},{"url":"https://research.checkpoint.com/2025/stealth-falcon-zero-day/","tags":["Exploit","Technical Description"]},{"url":"https://therecord.media/microsoft-cisa-zero-day-turkish-defense-org","tags":["Press/Media Coverage"]},{"url":"https://www.bleepingcomputer.com/news/security/stealth-falcon-hackers-exploited-windows-webdav-zero-day-to-drop-malware/","tags":["Press/Media Coverage"]},{"url":"https://www.darkreading.com/vulnerabilities-threats/stealth-falcon-apt-exploits-microsoft-rce-zero-day-mideast","tags":["Press/Media Coverage"]},{"url":"https://www.theregister.com/2025/06/10/microsoft_patch_tuesday_june/","tags":["Press/Media Coverage"]},{"url":"https://www.vicarius.io/vsociety/posts/cve-2025-33053-detection-script-remote-code-execution-vulnerability-in-microsoft-webdav","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.vicarius.io/vsociety/posts/cve-2025-33053-mitigation-script-remote-code-execution-vulnerability-in-microsoft-webdav","tags":["Exploit","Mitigation","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-33053","tags":["US Government Resource"]}],"techniques":[{"id":"T1566.001","name":"Spearphishing Attachment","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Other","mappingType":"exploitation_technique","evidence":[],"comment":"By manipulating the working directory of Windows processes, attackers can utilize these valid processes and trick them into running arbitrary code from a WebDAV server. This has been done by using a phishing email with a malicious PDF document attached, leading to code execution, the creation of backdoors, the introduction of a keylogger onto the system, and data exfiltration via C2.","confidence":"medium","confidenceNote":"CTID KEV capability group \"other\" is generic"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Other","mappingType":"primary_impact","evidence":[],"comment":"By manipulating the working directory of Windows processes, attackers can utilize these valid processes and trick them into running arbitrary code from a WebDAV server. This has been done by using a phishing email with a malicious PDF document attached, leading to code execution, the creation of backdoors, the introduction of a keylogger onto the system, and data exfiltration via C2.","confidence":"medium","confidenceNote":"CTID KEV capability group \"other\" is generic"},{"id":"T1041","name":"Exfiltration Over C2 Channel","tactics":["exfiltration"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Other","mappingType":"secondary_impact","evidence":[],"comment":"By manipulating the working directory of Windows processes, attackers can utilize these valid processes and trick them into running arbitrary code from a WebDAV server. This has been done by using a phishing email with a malicious PDF document attached, leading to code execution, the creation of backdoors, the introduction of a keylogger onto the system, and data exfiltration via C2.","confidence":"medium","confidenceNote":"CTID KEV capability group \"other\" is generic"},{"id":"T1056.001","name":"Keylogging","tactics":["collection","credential-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Other","mappingType":"secondary_impact","evidence":[],"comment":"By manipulating the working directory of Windows processes, attackers can utilize these valid processes and trick them into running arbitrary code from a WebDAV server. This has been done by using a phishing email with a malicious PDF document attached, leading to code execution, the creation of backdoors, the introduction of a keylogger onto the system, and data exfiltration via C2.","confidence":"medium","confidenceNote":"CTID KEV capability group \"other\" is generic"},{"id":"T1543","name":"Create or Modify System Process","tactics":["persistence","privilege-escalation"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Other","mappingType":"secondary_impact","evidence":[],"comment":"By manipulating the working directory of Windows processes, attackers can utilize these valid processes and trick them into running arbitrary code from a WebDAV server. This has been done by using a phishing email with a malicious PDF document attached, leading to code execution, the creation of backdoors, the introduction of a keylogger onto the system, and data exfiltration via C2.","confidence":"medium","confidenceNote":"CTID KEV capability group \"other\" is generic"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-17721","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-17721","exploited":true,"exploitedSince":"2025-06-10","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":5,"skipped":0,"earliest":"2025-06-12","earliestUrl":"https://github.com/DevBuiHieu/CVE-2025-33053-Proof-Of-Concept","repos":[{"name":"DevBuiHieu/CVE-2025-33053-Proof-Of-Concept","url":"https://github.com/DevBuiHieu/CVE-2025-33053-Proof-Of-Concept","stars":63,"created":"2025-06-12"},{"name":"kra1t0/CVE-2025-33053-WebDAV-RCE-PoC-and-C2-Concept","url":"https://github.com/kra1t0/CVE-2025-33053-WebDAV-RCE-PoC-and-C2-Concept","stars":3,"created":"2025-06-18"},{"name":"TheTorjanCaptain/CVE-2025-33053-Checker-PoC","url":"https://github.com/TheTorjanCaptain/CVE-2025-33053-Checker-PoC","stars":1,"created":"2025-06-18"},{"name":"4n4s4zi/CVE-2025-33053_PoC","url":"https://github.com/4n4s4zi/CVE-2025-33053_PoC","stars":1,"created":"2025-08-23"},{"name":"Cyberw1ng/CVE-2025-33053-POC","url":"https://github.com/Cyberw1ng/CVE-2025-33053-POC","stars":0,"created":"2025-12-18"}]},"metasploit":[{"name":"CVE-2025-33053 Exploit via Malicious .URL File and WebDAV","module":"exploit/windows/fileformat/unc_url_cve_2025_33053","type":"exploit","disclosureDate":"2025-06-11","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/unc_url_cve_2025_33053.rb"}],"first":{"date":"2025-06-11","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/unc_url_cve_2025_33053.rb"},"provenance":"source"},"detections":{"cveRules":[{"title":"Potential Exploitation of RCE Vulnerability CVE-2025-33053","id":"abe06362-a5b9-4371-8724-ebd00cd48a04","level":"high","status":"experimental","path":"rules-emerging-threats/2025/Exploits/CVE-2025-33053/proc_creation_win_exploit_cve_2025_33053.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-33053/proc_creation_win_exploit_cve_2025_33053.yml","techniques":["T1218","T1105"]},{"title":"Potential Exploitation of RCE Vulnerability CVE-2025-33053 - Image Load","id":"04fc4b22-91a6-495a-879d-0144fec5ec03","level":"high","status":"experimental","path":"rules-emerging-threats/2025/Exploits/CVE-2025-33053/image_load_win_exploit_cve_2025_33053.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-33053/image_load_win_exploit_cve_2025_33053.yml","techniques":["T1218","T1105"]},{"title":"Potential Exploitation of RCE Vulnerability CVE-2025-33053 - Process Access","id":"9a2d8b3e-f5a1-4c68-9e21-7d9e1cf8a123","level":"high","status":"experimental","path":"rules-emerging-threats/2025/Exploits/CVE-2025-33053/proc_access_win_exploit_cve_2025_33053.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-33053/proc_access_win_exploit_cve_2025_33053.yml","techniques":["T1218","T1105"]}]},"exploitRefs":["https://research.checkpoint.com/2025/stealth-falcon-zero-day/","https://www.vicarius.io/vsociety/posts/cve-2025-33053-detection-script-remote-code-execution-vulnerability-in-microsoft-webdav","https://www.vicarius.io/vsociety/posts/cve-2025-33053-mitigation-script-remote-code-execution-vulnerability-in-microsoft-webdav"],"flow":[{"stage":"exploitation","techniques":["T1566.001"],"provenance":"source"},{"stage":"primary","techniques":["T1059"],"provenance":"source"},{"stage":"secondary","techniques":["T1543","T1056.001","T1041"],"provenance":"source"}],"timeline":[{"date":"2025-06-10","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-33053","provenance":"source"},{"date":"2025-06-10","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2025-Jun","provenance":"source"},{"date":"2025-06-10","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-06-10","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-17721","provenance":"source"},{"date":"2025-06-11","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2025-06-12","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/unc_url_cve_2025_33053.rb","provenance":"source"}],"speed":{"daysToPublicExploit":1,"firstExploitFrom":"Metasploit","daysToKev":0},"priority":{"score":69.1,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 507 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.95,"detail":"percentile 0.9975"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"3 NVD references tagged Exploit; 5 PoC-in-GitHub repos; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.16,"detail":"base score 8.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}