Identity CVE · Other
CVE-2025-59280Windows SMB Client improper authentication (tampering)
high
What broke
The Windows SMB Client failed to authenticate a response the way it should (CWE-287, improper authentication). An attacker who can tamper with the exchange can modify what the client believes. Microsoft patched it.
Why it matters
SMB is how Windows still moves files and, too often, how it authenticates to file servers with the user's Kerberos ticket. Improper authentication on the client is how a network attacker becomes a participant in that identity. Read it next to the SMB/Kerberos reflection pair (CVE-2025-33073, CVE-2025-58726).
What to do
- Deploy the named Windows update on clients, not only on servers.
- Prefer SMB signing and encryption. A tampering bug is much less useful when the channel is bound.
- Watch for unexpected SMB referrals off your file-server namespace.
Sources
Related identity CVEs
Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.