CVE-2025-24054—Microsoft Windows NTLM Hash Disclosure Spoofing Vulnerability

Vulnerability Name

Microsoft Windows NTLM Hash Disclosure Spoofing Vulnerability

Description

Microsoft Windows NTLM contains an external control of file name or path vulnerability that allows an unauthorized attacker to perform spoofing over a network.

Known To Be Used in Ransomware Campaigns?

Ransomware Status:

Unknown

Action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Additional Notes

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24054
• https://nvd.nist.gov/vuln/detail/CVE-2025-24054

Related News Articles

• Exposed Server Reveals AI-Assisted Phishing Toolkit Behind WebDAV Malware CampaignJuly 20, 2026
• Microsoft August 2025 Patch Tuesday Fixes Kerberos Zero-Day Among 111 Total New FlawsAugust 13, 2025
• Microsoft Outlook to block more risky attachments used in attacksJune 10, 2025
• CVE-2025-24054 Under Active Attack—Steals NTLM Credentials on File DownloadApril 18, 2025
• Windows NTLM hash leak flaw exploited in phishing attacks on governmentsApril 17, 2025

Related Weaknesses

• CWE-73