CVE-2025-21311

The vulnerability is related to improper implementation of the NTLM authentication mechanism in version 1 (CWE-303 — error in the implementation of authentication protocol steps). An attacker can exploit the vulnerability remotely, without possessing any privileges and without user involvement, suggesting the possibility of conducting an attack directly on the NTLM network stack. The detailed technical mechanism has not been disclosed by the vendor.

Successful exploitation of the vulnerability allows an attacker to gain complete control over the system — obtaining confidential data, modifying data, and causing service unavailability (full impact on confidentiality, integrity, and availability).

Security updates published by Microsoft as part of the January 2025 Patch Tuesday should be applied immediately, available through Microsoft Update Catalog and WSUS. Additionally, it is recommended to consider disabling or restricting the use of NTLM V1 protocol in the environment according to Microsoft guidelines (Group Policy: 'Network security: LAN Manager authentication level').

Microsoft Windows 11 24H2, Microsoft Windows Server 2022 23H2, Microsoft Windows Server 2025