Windows Remote Code Execution via WebDAV and Internet Shortcuts (CVE-2025-33053)

Historical catalog analysis: CISA added this entry on June 10, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2025-33053 is an external control of file name or path vulnerability (CWE-73) affecting Microsoft Windows. The flaw allows an attacker to execute code from a remote WebDAV location. This is achieved by leveraging the WorkingDirectory attribute within Internet Shortcut files, which can be manipulated to point to a malicious remote source.

Exposure and applicability

This vulnerability applies to Windows environments where users may interact with Internet Shortcut files that reference external paths. The primary exposure path involves the processing of these shortcuts in a manner that allows the system to execute code from a remote WebDAV server. Organizations utilizing Windows across their infrastructure should evaluate the prevalence of WebDAV usage and the likelihood of users opening untrusted shortcut files.

Remediation priorities

Based on the inclusion of this vulnerability in CISA’s Known Exploited Vulnerabilities (KEV) catalog as of June 10, 2025, remediation should be prioritized for high-risk assets. Our analysis suggests the following priority sequence:

1. Vendor Mitigation Deployment: The primary corrective action is to apply the mitigations provided by Microsoft. This should be the first priority for all affected Windows endpoints.
2. Cloud Service Alignment: For organizations utilizing cloud services, remediation should align with BOD 22-01 guidance where applicable to ensure consistent exposure reduction across hybrid environments.
3. Service Decommissioning: In scenarios where vendor mitigations cannot be applied or are unavailable, the product or specific functionality facilitating the risk should be discontinued.

How to validate remediation

Verification must move beyond simple version checks, as a patched version does not inherently prove that the remote code execution path via WebDAV has been fully neutralized in a specific environment.

Defenders should verify mitigation by confirming the successful deployment of vendor-supplied updates across all targeted assets. To ensure exposure is reduced, security teams should validate that the system no longer honors malicious WorkingDirectory attributes pointing to remote WebDAV locations when processing Internet Shortcut files. This validation should be performed in a controlled environment using authorized testing methods to confirm the vulnerability is no longer exploitable.

Limits and open questions

While CISA has added this to the KEV catalog, it remains unknown whether this vulnerability is currently being utilized by ransomware campaigns. Additionally, while federal agencies are subject to a July 1, 2025, deadline for remediation, this date does not automatically apply to non-federal organizations, though it serves as a benchmark for urgency.

Residual risk remains if users can still be induced to execute files from remote sources via alternative mechanisms not covered by the specific fix for CVE-2025-33053. The effectiveness of the mitigation is dependent on the comprehensive application of vendor updates across all Windows instances in the environment.

Source and editorial note

CVE-2025-33053: Microsoft Windows External Control of File Name or Path Vulnerability · Source date: June 10, 2025 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: June 13, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: October 12, 2026 at 00:12 UTC.

Request a Vulnerability Assessment