EXPOSURES › CVE-2025-33053
CVE-2025-33053
HIGH ⌖ ON CISA KEV · EXPLOITEDMicrosoft Windows exposed to remote code execution via malicious WebDAV shortcuts
An unpatched vulnerability in Microsoft Windows allowed attackers to execute arbitrary code via a remote WebDAV location, posing a high risk to DIB organizations due to the ease of exploitation and the potential for significant data loss or corruption.
Shame score — Ease of exploitation and potential for significant data loss or corruption in DIB environments.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Microsoft Windows contains an external control of file name or path vulnerability that could allow an attacker to execute code from a remote WebDAV location specified by the WorkingDirectory attribute of Internet Shortcut files.
| PRODUCT | STATUS |
|---|---|
| Azure Commercial Cloud Microsoft |
Authorized |
| Azure Government (includes Dynamics 365) Microsoft |
Authorized |
| Microsoft Office 365 GCC High Microsoft |
In Process |
| Office 365 Multi-Tenant & Supporting Services Microsoft |
Authorized |