CVE-2025-33053: Microsoft Windows External Control of File Name or Path Vulnerability Enables Remote Code Execution via WebDAV Shortcuts
What It Is – Windows improperly validates the WorkingDirectory attribute of Internet Shortcut (.url) files. An attacker can host a malicious WebDAV share and craft a shortcut that causes Windows to load and execute code from that remote location.
Exploitability – Listed in the CISA Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. NVD assigns a CVSS v3.1 base score of 9.8 (Critical).
Affected Products – All supported releases of Microsoft Windows (Windows 10, Windows 11, Windows Server 2016‑2022).
Why It Matters for Trust & Control Assurance
- Patch Management – Demonstrable, continuous evidence that critical OS patches are applied is a core control across most frameworks.
- Secure Configuration – Controls that restrict execution from untrusted file paths and disable unnecessary services (e.g., WebDAV) reduce attack surface.
- Audit Readiness – Maintaining verifiable records of remediation actions satisfies auditors looking for a defensible remediation trail.
Recommended Actions
- Deploy Microsoft’s security update that resolves CVE‑2025‑33053 without delay.
- Verify patch deployment across all endpoints via automated inventory tools.
- Restrict or disable WebDAV and block execution of Internet Shortcut files from untrusted locations.
- Capture patch‑compliance evidence in your control repository for audit purposes.
Source: CISA KEV entry