CVE-2025-33073

HighCVSS 8.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Improper access control in Windows SMB allows an authorized attacker to elevate privileges over a network.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published
Jun 10, 2025
Last modified
Jun 17, 2026
Added to CISA KEV
Oct 20, 2025
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-330748.8Improper verification of cryptographic signature in Microsoft Azure Functions allows an authorized attacker to execute code over a network.CVE-2025-330757.8Improper link resolution before file access ('link following') in Windows Installer allows an authorized attacker to elevate privileges locaCVE-2025-330768.8IBM Engineering Systems Design Rhapsody 9.0.2, 10.0, and 10.0.1 is vulnerable to a stack-based buffer overflow, caused by improper bounds chCVE-2025-330778.8IBM Engineering Systems Design Rhapsody 9.0.2, 10.0, and 10.0.1 is vulnerable to a stack-based buffer overflow, caused by improper bounds chCVE-2025-330796.5IBM Controller 11.0.0, 11.0.1, and 11.1.0 application could allow an authenticated user to obtain sensitive credentials that may be inadvertCVE-2025-33089.8A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been declared as critical. Affected by this vulnerabilitCVE-2025-330815.5IBM Concert 1.0.0 through 2.1.0 stores potentially sensitive information in log files that could be read by a local user.CVE-2025-330825.4IBM Concert Software 1.0.0 through 1.1.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbCVE-2025-330835.4IBM Concert Software 1.0.0 through 1.1.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbCVE-2025-330845.9IBM Concert Software 1.0.0 through 1.1.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enCVE-2025-330887.4IBM Concert 1.0.0 through 2.1.0 could allow a local user with specific knowledge about the system's architecture to escalate their privilegeCVE-2025-330899.8IBM Concert 1.0.0 through 2.1.0 could allow a remote attacker to obtain sensitive information or perform unauthorized actions due to the use
CVE-2025-33073: High severity, CVSS 8.8 | Vulnix