Just in Time Bulletin: CVE-2025-33073 Reflective Kerberos Relay Attack

What is CVE-2025-33073?

CVE-2025-33073, also known as the Reflective Kerberos Relay Attack, is a critical privilege escalation vulnerability in Windows hosts. Discovered by RedTeam Pentesting in January 2025, this logical flaw bypasses existing NTLM reflection mitigations.

Key aspects of the vulnerability:

• Attack Mechanism: An attacker coerces a Windows host to authenticate via SMB. The attacker then relays the computer account’s Kerberos ticket back to the same host via SMB. This process incorrectly identifies certain DNS records as equivalent to localhost, leading to a local NTLM authentication and allowing the attacker to gain NT AUTHORITY\SYSTEM privileges.
• Impact: Successful exploitation can lead to remote code execution as SYSTEM on the vulnerable machine.
• Mitigation:
  • Microsoft released a patch for CVE-2025-33073 on June 10, 2025, as part of Patch Tuesday. The patch prevents SMB connections when a target name with marshalled target information is detected.
  • Enforcing SMB signing on Windows hosts is a crucial preventative measure against this and similar authentication relay vulnerabilities.

How bad is this?

According to the National Vulnerability Database (NVD), CVE-2025-33073 has a CVSS 3.x Base Score of 8.8 (HIGH) and is categorized under CWE-284 Improper Access Control.

Severity: Critical

• Domain access is required
• Trivial exploitation

Who is affected by this?

How is it exploited?

This vulnerability is exploitable remotely by an attacker authenticated to a local or domain user group.

How do I protect myself?

Microsoft has released a patch to address this vulnerability. Please reference the Microsoft advisory for version specific downloads.

Mitigating factors?

Enabling SMB signing prevents successful exploitation. This demonstrates the benefit of defense in depth, which in this instance neutralized the risk of a zero-day.

Additional Resources:

• https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-33073
• https://blog.redteam-pentesting.de/2025/reflective-kerberos-relay-attack/
• https://www.synacktiv.com/en/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025