CVE-2025-58726: Windows 10 1507 Privilege Escalation Flaw

CVE-2025-58726 Overview

CVE-2025-58726 is an improper access control vulnerability [CWE-284] in the Windows Server Message Block (SMB) Server. An authorized attacker with low privileges can exploit weaknesses in SMB access enforcement to elevate privileges over a network. Microsoft assigned a CVSS 3.1 base score of 7.5, reflecting high impact to confidentiality, integrity, and availability when the attack succeeds. The vulnerability affects a broad range of Windows client and server releases, from legacy Windows Server 2008 through Windows 11 25H2 and Windows Server 2025.

Critical Impact
A network-based attacker with valid low-privilege credentials can escalate to higher privileges through the SMB Server, expanding access to file shares, services, and domain resources reachable via SMB.

Affected Products

Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (22H2, 23H2, 24H2, 25H2)
Microsoft Windows Server 2008, 2012, 2012 R2, 2016, 2019, 2022, 2022 23H2, and 2025

Discovery Timeline

2025-10-14 - CVE-2025-58726 published to the National Vulnerability Database
2025-11-11 - Last updated in NVD database

Technical Details for CVE-2025-58726

Vulnerability Analysis

The flaw resides in how the Windows SMB Server enforces access control on protected operations. SMB is the protocol that handles file sharing, printer sharing, and named-pipe communication across Windows networks. An authenticated attacker with low privileges can issue crafted SMB requests that bypass intended authorization checks. The result is elevation of privilege on the targeted server. Exploitation requires network access to TCP port 445 and valid credentials, even if those credentials belong to a standard user or non-privileged service account.

The CVSS vector indicates high attack complexity, suggesting that successful exploitation depends on specific conditions such as race windows, particular SMB session states, or precise sequencing of protocol messages. Once those conditions are met, the impact spans all three security properties: an attacker can read protected data, modify resources, and disrupt SMB service availability.

Root Cause

The root cause is improper access control [CWE-284] inside the SMB Server component. Authorization decisions for one or more SMB operations do not correctly validate the requesting principal's effective rights against the resource being accessed. This logic gap allows an authorized but low-privilege session to perform operations reserved for higher-privilege accounts.

Attack Vector

The attack vector is Network. An attacker authenticates to the SMB Server using any valid account, then sends a sequence of SMB requests designed to trigger the access control flaw. No user interaction is required on the target. Because SMB is commonly reachable across internal network segments and, in misconfigured environments, sometimes exposed to broader networks, the vulnerability is well-suited for lateral movement after initial foothold. Microsoft has not disclosed exploitation in the wild, and the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

No public proof-of-concept code is available. Refer to the Microsoft Security Response Center advisory for vendor technical details.

Detection Methods for CVE-2025-58726

Indicators of Compromise

Unexpected SMB sessions from low-privilege accounts performing administrative operations such as accessing ADMIN$, C$, or IPC$ named pipes.
Anomalous Windows Security event IDs 4624 (logon) and 4672 (special privileges assigned) on file and domain servers following SMB activity from non-administrative users.
Spikes in SMB protocol errors or unusual command sequences on TCP port 445 from a single source host.

Detection Strategies

Hunt for SMB sessions in which an authenticated low-privilege user invokes operations that normally require elevated rights, correlating Security event log entries with SMBServer operational logs (Microsoft-Windows-SMBServer/Operational).
Apply the Vicarius detection script for CVE-2025-58726 to identify unpatched hosts across the estate.
Baseline normal SMB behavior per account and alert on deviations such as new shares being enumerated or written by accounts without prior history.

Monitoring Recommendations

Forward SMBServer and SMBClient operational logs to a centralized SIEM and retain them for at least 90 days.
Monitor network telemetry for SMB traffic between non-administrative workstations and domain controllers or file servers, which is rarely legitimate.
Alert on creation or modification of services, scheduled tasks, or registry keys on remote hosts immediately following SMB authentication events.

How to Mitigate CVE-2025-58726

Immediate Actions Required

Apply the Microsoft security update for CVE-2025-58726 to all affected Windows client and server systems, prioritizing domain controllers, file servers, and externally reachable hosts.
Audit and reduce SMB exposure by blocking TCP port 445 at the network perimeter and segmenting SMB traffic between user and server zones.
Enforce least privilege on service and user accounts that authenticate to SMB shares, removing unnecessary access to administrative shares.

Patch Information

Microsoft has released security updates addressing CVE-2025-58726 across all supported Windows versions. Update details and download links are available through the Microsoft CVE-2025-58726 advisory. Apply the cumulative update corresponding to each operating system version through Windows Update, WSUS, or Microsoft Update Catalog.

Workarounds

Restrict SMB access to trusted management networks using Windows Defender Firewall rules and network ACLs until patches are deployed.
Enable SMB signing on both clients and servers to raise the bar for SMB protocol abuse.
Disable SMBv1 entirely on systems where it remains enabled, and ensure only SMBv3 with encryption is used for sensitive shares.
Use the Vicarius mitigation script for CVE-2025-58726 as a reference for hardening configurations.

bash

# Configuration example: enforce SMB signing and disable SMBv1 via PowerShell
Set-SmbServerConfiguration -RequireSecuritySignature $true -EnableSecuritySignature $true -Force
Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force

# Restrict inbound SMB to specific management subnets
New-NetFirewallRule -DisplayName "Restrict SMB 445 Inbound" -Direction Inbound -Protocol TCP -LocalPort 445 -RemoteAddress 10.10.0.0/24 -Action Allow
New-NetFirewallRule -DisplayName "Block SMB 445 Inbound Default" -Direction Inbound -Protocol TCP -LocalPort 445 -Action Block