Windows SMB Client Vulnerability Exposes Organizations to Full Active Directory Compromise 

CVE-2025-33073 is a critical logical flaw in the Windows SMB client NTLM reflection handling that allows authenticated attackers to relay authentication and inherit LSASS SYSTEM tokens, enabling SYSTEM-level privilege escalation and complete Active Directory compromise across domains; researchers demonstrate cross-protocol relay to LDAP/LDAPS (and Kerberos reflection variants), exploitation with modified public tools is trivial, many systems remain unpatched, and mitigations include applying Microsoft updates, enforcing SMB signing and channel binding, restricting DNS registration, and blocking NetNTLMv1.