CVE-2025-59280Windows SMB Client improper authentication (tampering)
What broke
The Windows SMB Client failed to authenticate a response the way it should (CWE-287, improper authentication). An attacker who can tamper with the exchange can modify what the client believes. Microsoft patched it.
Why it matters
SMB is how Windows still moves files and, too often, how it authenticates to file servers with the user's Kerberos ticket. Improper authentication on the client is how a network attacker becomes a participant in that identity. Read it next to the SMB/Kerberos reflection pair (CVE-2025-33073, CVE-2025-58726).
What to do
- Deploy the named Windows update on clients, not only on servers.
- Prefer SMB signing and encryption. A tampering bug is much less useful when the channel is bound.
- Watch for unexpected SMB referrals off your file-server namespace.
After you patch
Patching closes the entry point. It does not remove access an attacker established through it.
- Revoke sessions and API tokens on the affected system rather than only resetting passwords.
- Audit accounts, tokens, and administrative changes made during the exposure window.
- Rotate credentials the system stored or could reach, including directory service accounts and integration keys. See secrets rotation.
- Treat the system as a pivot: whatever it could authenticate to is in scope until you have checked it.
Sources
Related identity CVEs
Related on Start with Identity
- BlogA CVE ID is a name. The value is knowing who the attacker becomes.
We opened a practitioner catalog of identity CVEs: what broke, why IAM teams should care, and what to do this week. Not an NVD mirror. A place to triage SAML wr
- GlossaryClient Credentials Grant
An OAuth 2.0 flow where an application authenticates as itself, with no user present, to obtain an access token. The standard pattern for machine-to-machine acc
- BlogGoogle Workspace puts FIDO2 keys into the Windows login, days after Entra makes passkeys default
Google began rolling out FIDO2 security keys as a second factor at Windows sign-in for all Workspace customers on 13 July. Microsoft is making passkeys the defa
- CVEKeycloak client policy enforcement flaw
A 2026 Keycloak client-policy enforcement bug. Client policies are how you ban implicit flow, require PKCE, or force FAPI. If they do not fire, the realm's writ
- BlogMalware can drive a Windows Hello key for Entra ID persistence without a PIN prompt
Dirk-jan Mollema showed that code running in a signed-in Windows session can use the victim's TPM-bound Windows Hello for Business key as a FIDO2 credential, sa
- CVEN-able N-central auth bypass, incomplete patch of CVE-2026-18556
N-able N-central authentication bypass and account takeover. The first fix (CVE-2026-18556) was incomplete. Actively exploited. CISA added it to KEV on 3 August