Is CVE-2025-33053 (Microsoft Windows External Control of File Name or Path) being exploited in the wild?

Yes. CISA added CVE-2025-33053 to its Known Exploited Vulnerabilities catalogue on 10 June 2025, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Microsoft Windows contains an external control of file name or path vulnerability that could allow an attacker to execute code from a remote WebDAV location specified by the WorkingDirectory attribute of Internet Shortcut files.

What this CVE means operationally

This is not a theoretical issue. The KEV listing means defenders should treat CVE-2025-33053 as an active exploitation concern, not a routine patch queue item. For Windows environments, the practical question is whether any endpoint, server or user workflow can open Internet Shortcut files that point to a remote WebDAV path and then execute content from that location.

Because the vulnerable behavior is tied to file handling and path resolution, exposure can exist anywhere users or automation consume shortcut files from untrusted sources. That is why the issue belongs in the same response lane as other actively exploited vulnerabilities: confirm exposure first, then compress the time from detection to containment and remediation.

For most teams, the first decision is not whether the flaw is “important enough,” but whether the affected path is reachable in practice. If Internet Shortcut handling is enabled in business workflows, remote content can become the trigger point even when the initial user action looks harmless.

How exploitation typically becomes a breach path

The core abuse pattern is simple: an attacker places or lures a victim into opening a crafted Internet Shortcut file whose WorkingDirectory attribute points to attacker-controlled WebDAV content. If Windows resolves and executes from that remote location, the shortcut becomes a code-execution bridge rather than just a navigation aid.

That makes the weakness attractive for initial access and follow-on execution because it can blend into ordinary file activity. A malicious shortcut can arrive through email, messaging, web downloads, shared folders or other user-facing transfer paths, then hand the attacker a foothold without requiring a separate exploit chain.

This is also why compromise assessment matters after exposure. If the shortcut was opened before blocking, defenders should assume the system may have executed attacker-hosted content and look for the resulting process creation, network connections to WebDAV endpoints, unusual child processes and any staged payloads that followed the first execution.

What defenders should do before and after patching

Start by confirming whether any systems actually process Internet Shortcut files from untrusted sources, then move to vendor guidance and the CISA KEV record for the exact fix and remediation steps. If patching must wait, reduce exposure by restricting delivery of shortcut files, limiting user-driven execution paths and constraining outbound access to remote file locations that should not be used operationally.

When the environment includes broad Windows file sharing or many endpoints with user-driven downloads, prioritise containment over convenience. The issue is not only whether the vulnerable code exists, but whether a realistic workflow lets an attacker place a shortcut where execution is likely.

After remediation, validate that the change actually closes the path. A patch is only part of the answer if the organisation still allows the same file type and trust boundary to be abused through alternate delivery routes or stale cached content.

Risk and Threat Considerations

Active exploitation changes the risk profile from “known bug” to “probable intrusion path.” The main danger is remote code execution triggered through a file format users commonly trust, which can make initial access look like normal document handling rather than malicious activity.

Failure mechanism: A crafted Internet Shortcut file resolves its WorkingDirectory to attacker-controlled WebDAV content, and Windows executes code from that remote location before defenders notice the trust boundary was crossed.

Impact: The result can be endpoint compromise, payload staging, credential theft, lateral movement or broader incident response work if the shortcut was opened in a privileged or widely deployed context.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack surface, CIS Controls v8 and NIST SP 800-53 Rev 5 set the technical controls, and ISO/IEC 27001:2022 defines the regulatory obligations.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Active exploitation requires prioritising and remediating known vulnerable Windows assets.
Recommendation — Prioritise and remediate KEV-listed Windows systems through continuous vulnerability management.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	This CVE calls for rapid remediation and verification of vulnerable Windows software.
	SI-4 — System Monitoring	Post-exploitation hunting depends on detecting execution and suspicious remote access after shortcut abuse.
	SI-3 — Malicious Code Protection	Blocking or screening risky file content helps reduce exposure to malicious shortcut-delivered payloads.
Recommendation — Accelerate flaw remediation and confirm vulnerable hosts are updated or mitigated. Monitor for suspicious execution and network activity tied to remote shortcut handling. Block or screen untrusted file content that can deliver malicious payloads.
ISO/IEC 27001:2022	A.8.8 — Management of technical vulnerabilities	This is an exploited vulnerability that requires organised remediation and verification.
	A.8.7 — Protection against malware	Exploit delivery through shortcut files can introduce malicious payloads that malware controls help contain.
Recommendation — Track, prioritise and remediate the vulnerability through formal technical vulnerability management. Use malware protection to block or contain payloads introduced through malicious files.
MITRE ATT&CK	T1204 — User Execution	The exploit path depends on a victim opening a crafted shortcut file to trigger execution.
	T1105 — Ingress Tool Transfer	Remote WebDAV content can be used to stage or retrieve payloads after initial execution.
	T1059 — Command and Scripting Interpreter	If the shortcut leads to code execution, attackers often chain to script or shell execution.
Recommendation — Hunt for and reduce user-driven execution of suspicious shortcut files. Detect and disrupt remote payload retrieval from attacker-controlled infrastructure. Inspect for script or shell execution that follows suspicious shortcut activity.

Practitioner Guidance

What to verify: Confirm which business processes, users or automations can open Internet Shortcut files and whether those files can originate outside trusted internal workflows. If you cannot answer that quickly, you do not yet know your real exposure.

Decision rule: If the environment accepts shortcut files from external sources, treat this as a contain-and-remediate event, not a monitor-only issue. If the files are blocked by policy or sanitised at ingress, verify the control with test samples rather than assuming the filter is effective.

What practitioners underestimate: The first compromise signal may not be the shortcut itself, but the remote connection and process tree that follows it. Hunting only for the CVE name can miss the more important question of what the system did immediately after opening the file.

Practitioner takeaway: For KEV-listed file-execution issues, the key judgement is whether the trust boundary is still reachable, because that determines whether patching alone is enough or whether you need immediate exposure reduction and compromise hunting.