Microsoft Windows NTLM Spoofing Vulnerability (CVE-2025-24054)

Historical catalog analysis: CISA added this entry on April 17, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2025-24054 is a vulnerability in Microsoft Windows NTLM categorized as an external control of file name or path (CWE-73). This flaw allows an unauthorized attacker to perform spoofing over a network. The vulnerability was added to the CISA Known Exploited Vulnerabilities catalog on April 17, 2025.

Exposure and applicability

This vulnerability affects systems utilizing Microsoft Windows NTLM. Because the attack vector is network-based, exposure exists where NTLM authentication is active and reachable by unauthorized actors. For U.S. federal agencies, CISA has established a remediation deadline of May 8, 2025; however, this specific date serves as a benchmark for urgency rather than a mandate for private sector organizations.

Remediation priorities

Based on the reported vulnerability, our analysis suggests the following prioritization for vulnerability management teams:

1. Vendor Mitigation Deployment: The primary corrective action is to apply mitigations according to Microsoft’s official instructions.
2. Cloud Service Alignment: For organizations utilizing cloud services, we recommend reviewing and applying guidance consistent with BOD 22-01 to ensure the vulnerability is addressed across hybrid environments.
3. Product Decommissioning: In scenarios where vendor mitigations cannot be applied or are unavailable for specific legacy versions, the source indicates that discontinuing use of the affected product is a necessary alternative to eliminate exposure.

How to validate remediation

To ensure that exposure has been reduced, defenders should move beyond simple version checks. We recommend the following validation approach:

• Configuration Audit: Verify that the specific registry keys or group policy settings mandated by the vendor mitigation have been applied across all targeted endpoints and servers.
• Network Traffic Analysis: Monitor for unauthorized NTLM authentication attempts to ensure that spoofing vectors are no longer viable in the environment.
• Verification of Result: A deployed patch is a process; a verified result is evidence that the network-based spoofing path is closed. Validation should focus on confirming the absence of the vulnerable configuration state.

Limits and open questions

It remains unknown whether this vulnerability has been utilized by ransomware campaigns. Additionally, while vendor mitigations are available, there may be residual risk if NTLM is required for legacy application compatibility, as disabling or restricting NTLM can impact operational availability. The effectiveness of the mitigation depends on the comprehensive application of vendor instructions across all network-accessible Windows assets.

Source and editorial note

CVE-2025-24054: Microsoft Windows NTLM Hash Disclosure Spoofing Vulnerability · Source date: April 17, 2025 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: April 20, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: October 18, 2026 at 00:16 UTC.

Request a Vulnerability Assessment