New Zero-Click NTLM Credential Leak Exploit Bypasses Microsoft Patch for CVE-2025-24054

Cymulate Research Labs disclosed CVE-2025-50154, a zero-click vulnerability that bypasses Microsoft’s earlier CVE-2025-24054 patch by forcing Windows Explorer to retrieve remote binaries for LNK icon extraction, leaking NTLMv2-SSP hashes and exposing systems to credential theft, privilege escalation, lateral movement, and potential remote code execution; Microsoft has acknowledged the issue and a patch is expected.