CVE-2025-24054: Microsoft Windows NTLM Hash Disclosure Spoofing Vulnerability

CVE-2025-24054 is a spoofing vulnerability in Microsoft Windows NTLM that stems from external control of a file name or path. An unauthorized attacker on the network can abuse this to perform spoofing, which in the NTLM context commonly risks disclosure of authentication material such as hashes. Because NTLM remains widely used for authentication across Windows environments, successful abuse can enable further credential-based attacks. Specifics of impact and affected builds must be confirmed against the Microsoft vendor advisory.

Defenders should treat this as a network-reachable authentication-related spoofing issue and prioritize inventory and remediation of Windows systems that still rely on NTLM.

How it works

The underlying weakness is CWE-73: external control of file name or path. In this class of flaw, an attacker supplies or influences a path or filename that the system later uses in a security-sensitive operation. For Microsoft Windows NTLM, the CISA summary states that the product contains such a vulnerability allowing an unauthorized attacker to perform spoofing over a network.

In practical terms for this vulnerability class, the attacker crafts a network interaction that causes a Windows host or client to treat an attacker-controlled path as legitimate. That interaction can trigger NTLM authentication toward a location the attacker chooses, resulting in hash disclosure or other spoofing effects. Exact trigger conditions, required user interaction, and precise protocol messages are not detailed here; teams must obtain those mechanics from the vendor advisory rather than assuming a particular exploit path.

Am I affected? How to find it in your systems

The vulnerability affects Microsoft Windows. NTLM is present by default on most Windows client and server editions and is commonly used for file shares, remote administration, legacy applications, and some authentication fallback scenarios. Cloud-hosted Windows instances and hybrid identity environments that still permit NTLM are also in scope until confirmed otherwise.

Inventory steps:

• Enumerate all Windows endpoints and servers via existing asset management, Microsoft Endpoint Manager / Intune, SCCM/MECM, Active Directory computer objects, or vulnerability scanners that report OS build and patch level.
• Identify systems that still allow NTLM authentication (check Group Policy, local security policy, and Azure AD / Entra ID settings that control NTLM usage or restriction).
• Review configurations that accept or generate file paths or UNC paths from untrusted network sources, as these are typical attack surfaces for CWE-73 issues involving NTLM.
• Confirm exact affected versions and any required configuration against the Microsoft security advisory for CVE-2025-24054; do not rely on generic version ranges.

Telemetry and log signs of potential exploitation (general for this class):

• Unexpected outbound NTLM authentication attempts to external or unusual IP addresses or hostnames.
• Windows Security event logs showing NTLM authentication failures or successes to non-corporate destinations (Event IDs related to logon and NTLM).
• SMB or WebDAV connection attempts involving suspicious UNC paths.
• EDR or network detections of NTLM hash capture or relay-style activity. Correlate with the vendor’s published indicators once available.

How to remediate

Patch first. Apply the security update provided by Microsoft for CVE-2025-24054 according to the vendor instructions. Follow the CISA required action: apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

After patching, harden the NTLM attack surface:

• Restrict or disable NTLM where possible via Group Policy (Network security: Restrict NTLM settings) and prefer Kerberos or modern authentication.
• Enforce SMB signing and channel binding where supported to reduce relay and spoofing utility.
• Audit and remove unnecessary use of UNC paths or features that automatically resolve attacker-supplied names.
• Validate that the applied update appears in your patch-compliance reports and re-scan critical systems.

If you can't patch immediately

Implement compensating controls while scheduling the vendor update:

• Network segmentation: limit which hosts can initiate or receive NTLM/SMB traffic; block outbound SMB (TCP 445) and related ports to untrusted networks at the firewall.
• Disable or tightly control the features that process untrusted file paths or automatic network authentication if the advisory identifies a specific component.
• Virtual patching / detection: deploy IDS/IPS or EDR rules that flag anomalous NTLM authentication or suspicious UNC path usage; tune for false positives in your environment.
• Monitoring: increase alerting on NTLM logon events to external destinations and on any spoofing-related indicators published by Microsoft or CISA.
• For cloud Windows instances, apply the equivalent configuration baselines and follow BOD 22-01 guidance until the patch is installed.

These measures reduce exposure but do not replace the official update. Confirm any temporary workarounds against the vendor advisory before relying on them.

If your data may have been exposed

Actively exploited vulnerabilities of this type can lead to credential theft and subsequent breaches even when ransomware use is not documented for the CVE. If you observe indicators of exploitation or suspect NTLM hashes were disclosed, rotate affected credentials, review authentication logs for lateral movement, and follow your incident-response plan. You can also run a free exposure scan of your email addresses against known breach data to check whether related accounts have appeared in prior incidents.