CVE-2025-50154
Published Aug 12, 2025
Last updated 6 months ago
- Description
- Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over a network.
- Source
- secure@microsoft.com
- NVD status
- Analyzed
- Products
- windows_10_1507, windows_10_1607, windows_10_1809, windows_10_21h2, windows_10_22h2, windows_11_22h2, windows_11_23h2, windows_11_24h2, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022, windows_server_2022_23h2, windows_server_2025
CVSS 3.1
- Type
- Secondary
- Base score
- 6.5
- Impact score
- 3.6
- Exploitability score
- 2.8
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- Severity
- MEDIUM
- secure@microsoft.com
- CWE-200
- Hype score
- Not currently trending
Browsing a folder shouldn't leak your credentials, but a new Windows Explorer flaw does exactly that. OPSWAT Cybersecurity Fellowship participants break down CVE-2025-50154 and how to protect yourself. Dig into the analysis. https://t.co/kIxvYYEjOJ https://t.co/J6x5yP0XNb
@OPSWAT
12 Feb 2026
92 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Zero Click, One NTLM: Microsoft Security Patch Bypass (CVE-2025-50154) https://t.co/NNkCef1mqO
@johntroony
10 Jan 2026
69 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
The easiest way to exploit 0-Click vulnerability CVE-2025-50154 Just create an LNK file https://t.co/71pbn2de4r
@Jane_0sint
15 Nov 2025
174 Impressions
0 Retweets
1 Like
0 Bookmarks
0 Replies
0 Quotes
The easiest way to exploit vulnerability CVE-2025-50154 Just create an LNK file https://t.co/Erh8ZqJ9uP
@Jane_0sint
15 Nov 2025
5 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
¿Habéis visto el vídeo que he subido a las 19:00? Trata de cómo Windows, sin si quiera saberlo, compartía tus credenciales con los atacantes mediante el explorador de archivos. Exactamente trata de los CVE-2025-24071 y CVE-2025-50154. ¡Vulnerabilidades de este año!🆕
@ShadowRooted
8 Nov 2025
3 Impressions
0 Retweets
1 Like
0 Bookmarks
1 Reply
0 Quotes
The following vulnerabilities have been added to our feed: - CVE-2025-33053: Microsoft Windows Internet Shortcut Files RCE - CVE-2025-25257: Fortinet FortiWeb RCE - CVE-2025-50154: Microsoft Windows File Explorer NTLM Leak https://t.co/av7UZS4l6H
@crowdfense
16 Oct 2025
2191 Impressions
3 Retweets
23 Likes
7 Bookmarks
0 Replies
0 Quotes
CVE-2025-50154 Microsoft Windows File Explorer Spoofing Vulnerability https://t.co/wnzgsR0oHx #SecQube #cybersecurity
@SecQube
18 Sept 2025
0 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
POC for CVE-2025-50154, a zero day vulnerability on windows file explorer disclosing NTLMv2-SSP without user interaction. It is a bypass for the CVE-2025-24054 Security Patch
@Jeyso215
8 Sept 2025
120 Impressions
0 Retweets
0 Likes
0 Bookmarks
1 Reply
0 Quotes
Beware the Cursed Shortcut (CVE-2025-50154) — a zero-click vulnerability in File Explorer that steals NTLM hashes at a mere glance. Patch now or risk letting the killer rabbit slip through your gates. https://t.co/mjtJ0M6O8M
@vicariusltd
20 Aug 2025
35 Impressions
0 Retweets
1 Like
0 Bookmarks
0 Replies
0 Quotes
Zero Click, One NTLM: Microsoft Security Patch Bypass (CVE-2025-50154) By: Ruben Enkaoua https://t.co/J3yxOUiPGu https://t.co/mnqz39hviv
@7h3h4ckv157
19 Aug 2025
3681 Impressions
18 Retweets
84 Likes
35 Bookmarks
1 Reply
0 Quotes
𝗭𝗲𝗿𝗼 𝗖𝗹𝗶𝗰𝗸, 𝗢𝗻𝗲 𝗡𝗧𝗟𝗠: 𝗠𝗶𝗰𝗿𝗼𝘀𝗼𝗳𝘁 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗣𝗮𝘁𝗰𝗵 𝗕𝘆𝗽𝗮𝘀𝘀 A newly discovered zero-click vulnerability, CVE-2025-50154, bypasses a Microsoft patch, allo
@0x534c
13 Aug 2025
28869 Impressions
66 Retweets
252 Likes
206 Bookmarks
1 Reply
1 Quote
Zero Click, One NTLM: Microsoft Security Patch Bypass (CVE-2025-50154) https://t.co/SfjlNVimhm https://t.co/OhJRkFiVeh
@5mukx
13 Aug 2025
11140 Impressions
54 Retweets
267 Likes
128 Bookmarks
3 Replies
0 Quotes
CVE-2025-50154:Zero Click, One NTLM: Patch Bypass - https://t.co/gX2CwP09XP
@piedpiper1616
13 Aug 2025
1150 Impressions
5 Retweets
21 Likes
9 Bookmarks
1 Reply
0 Quotes
Find the POC for my new finding, CVE-2025-50154, a zero day vulnerability on windows file explorer disclosing NTLMv2-SSP without user interaction. It is a bypass for the CVE-2025-24054 Security Patch. https://t.co/JKA8zuyYnl
@RubenLabs
13 Aug 2025
1822 Impressions
17 Retweets
24 Likes
6 Bookmarks
1 Reply
0 Quotes
Zero Click, One NTLM: Microsoft Security Patch Bypass (CVE-2025-50154) https://t.co/whuakYDRVC
@ipurple
12 Aug 2025
3596 Impressions
16 Retweets
71 Likes
37 Bookmarks
1 Reply
0 Quotes
You didn’t click, but your password challenge is leaked. I’m excited to share my latest research: CVE-2025-50154, a high severity NTLM hash disclosure vulnerability in the explorer.exe process, exploitable without any user interaction. https://t.co/ssA9YdBE6J
@RubenLabs
12 Aug 2025
4665 Impressions
19 Retweets
55 Likes
38 Bookmarks
0 Replies
4 Quotes
Zero Click, One NTLM: Microsoft Security Patch Bypass (CVE-2025-50154) https://t.co/3jH4C9Tz17 https://t.co/d0lmBk0L2O
@secharvesterx
12 Aug 2025
69 Impressions
0 Retweets
1 Like
0 Bookmarks
0 Replies
0 Quotes
Zero Click, One NTLM: Microsoft Security Patch Bypass (CVE-2025-50154) https://t.co/W5xWsbvEck
@_r_netsec
12 Aug 2025
1437 Impressions
2 Retweets
7 Likes
6 Bookmarks
0 Replies
0 Quotes
CVE-2025-50154 Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over a network. https://t.co/IIDkpy4gJL
@CVEnew
12 Aug 2025
231 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x64:*",
"matchCriteriaId": "29F441C0-F0F8-463F-B141-6A33EBA06B1D",
"versionEndExcluding": "10.0.10240.21100",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x86:*",
"matchCriteriaId": "5C7C5886-496D-4CBA-956A-A097AC7535D4",
"versionEndExcluding": "10.0.10240.21100",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*",
"matchCriteriaId": "4E2D87DA-8EFF-4BB0-B025-A13C3F523BD1",
"versionEndExcluding": "10.0.14393.8330",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*",
"matchCriteriaId": "C28DF998-E700-4675-9737-40A53288F54C",
"versionEndExcluding": "10.0.14393.8330",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*",
"matchCriteriaId": "3A513AB8-ED03-4BCF-8077-09A117254263",
"versionEndExcluding": "10.0.17763.7678",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*",
"matchCriteriaId": "47A8837D-AB4B-465B-8D1C-B89B4EDDBDD4",
"versionEndExcluding": "10.0.17763.7678",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*",
"matchCriteriaId": "77A19D12-C137-4E01-AF99-E1E7BBC9F0C3",
"versionEndExcluding": "10.0.19044.6216",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*",
"matchCriteriaId": "44D27317-F93F-418E-8EC6-9BD1256677C9",
"versionEndExcluding": "10.0.19045.6216",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B07546D0-ED2A-4B93-83E7-EA808DC39724",
"versionEndExcluding": "10.0.22621.5768",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:*",
"matchCriteriaId": "49E4DFC9-7EB4-4577-83C0-D1E94C2A8D97",
"versionEndExcluding": "10.0.22631.5768",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6376F067-CC36-4A7B-914B-0A60EFF1AC48",
"versionEndExcluding": "10.0.26100.4851",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:*",
"matchCriteriaId": "2127D10C-B6F3-4C1D-B9AA-5D78513CC996",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x86:*",
"matchCriteriaId": "AB425562-C0A0-452E-AABE-F70522F15E1A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*",
"matchCriteriaId": "AF07A81D-12E5-4B1D-BFF9-C8D08C32FF4F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A7DF96F8-BA6A-4780-9CA3-F719B3F81074",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*",
"matchCriteriaId": "DB18C4CE-5917-401E-ACF7-2747084FD36E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*",
"matchCriteriaId": "CD31CC61-6C1C-4232-87D7-E5B4FEBB1276",
"versionEndExcluding": "10.0.14393.8330",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D224ABEA-CCE3-4D7D-86B5-5BEDBF83303B",
"versionEndExcluding": "10.0.17763.7678",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F752199D-6C01-4D8E-BD6C-3031E5CAED20",
"versionEndExcluding": "10.0.20348.3989",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*",
"matchCriteriaId": "94E45649-92F4-4D4C-9D94-275506530222",
"versionEndExcluding": "10.0.25398.1791",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B75BE97E-C12D-4DFB-B5F2-B8BF90C3E64E",
"versionEndExcluding": "10.0.26100.4851",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]