CISA: High-severity Windows SMB flaw now exploited in attacks

CVE-2025-33073 is a high-severity Windows SMB privilege escalation vulnerability affecting Windows Server, Windows 10, and Windows 11 up to 24H2; Microsoft issued a patch in June 2025 after researchers reported an improper access control weakness that can grant SYSTEM privileges when a victim is coerced to connect to a malicious SMB server. CISA reports active exploitation and added the flaw to its Known Exploited Vulnerabilities Catalog, directing federal agencies to patch within three weeks and urging all organizations to apply updates promptly.