# Windows SMB Client improper authentication (tampering)

Source: https://startwithidentity.com/cves/cve-2025-59280/
Last updated: 2026-08-29
License: content by Start with Identity. Cite the source URL.

---

## What broke

The Windows SMB Client failed to authenticate a response the way it should (CWE-287, improper authentication). An attacker who can tamper with the exchange can modify what the client believes. Microsoft patched it.

## Why it matters

SMB is how Windows still moves files and, too often, how it authenticates to file servers with the user's Kerberos ticket. Improper authentication on the client is how a network attacker becomes a participant in that identity. Read it next to the SMB/Kerberos reflection pair ([CVE-2025-33073](https://startwithidentity.com/cves/cve-2025-33073/), [CVE-2025-58726](https://startwithidentity.com/cves/cve-2025-58726/)).

## What to do

- Deploy the named Windows update on clients, not only on servers.
- Prefer SMB signing and encryption. A tampering bug is much less useful when the channel is bound.
- Watch for unexpected SMB referrals off your file-server namespace.

## After you patch

Patching closes the entry point. It does not remove access an attacker established through it.

- **Revoke sessions and API tokens** on the affected system rather than only resetting passwords.
- **Audit accounts, tokens, and administrative changes** made during the exposure window.
- **Rotate credentials the system stored or could reach**, including directory service accounts and integration keys. See [secrets rotation](https://startwithidentity.com/glossary/secrets-rotation/).
- **Treat the system as a pivot**: whatever it could authenticate to is in scope until you have checked it.

## Sources

- [NVD: CVE-2025-59280](https://nvd.nist.gov/vuln/detail/CVE-2025-59280)