Incomplete Windows Patch Exposes NTLM Credentials Again: CVE-2025-50154 Threat Analysis

The Patch That Didn't Hold

Cymulate Research Labs has disclosed CVE-2025-50154, a zero-click NTLM credential leak affecting fully patched Windows 10 and Windows Server 2008–2022.

The flaw bypasses Microsoft's fix for CVE-2025-24054 and lets attackers steal credentials and deliver malware without any user interaction.

It comes down to a loophole left in Microsoft's April 2025 patch, which means systems everyone considered secure are still exploitable. Attackers can harvest NTLMv2 hashes for credential cracking or relay attacks, escalate privileges, and move laterally through a network.

As a detection engineer, the part that bugs me is that "patched" became a false signal here. If your dashboard turned green in April and you stopped watching, this is the kind of bypass that walks right through.

---

At a Glance

Field	Value
CVE ID	CVE-2025-50154
CVSS Score	7.5 (High)
Type	Zero-click authentication bypass, patch evasion
Privileges	None
User Interaction	None
Authentication	None
Products Affected	Windows 10, Windows Server 2008–2022

---

How the Bypass Works

The original fix

In April 2025, Microsoft patched CVE-2025-24054, which blocked UNC path-based malicious icons in .lnk files. Cymulate found you can sidestep that by embedding icons inside remote executable files instead.

The exploit chain

1. The attacker hosts a crafted executable (execute.exe) on a malicious SMB server.
2. They create a .lnk file with:
   • TargetPath: the SMB-hosted binary
   • Icon location: a local safe file (e.g., C:\Windows\System32\SHELL32.dll)
3. They distribute the shortcut via email, USB, network share, or drive-by download.
4. When Explorer renders the shortcut, it reaches out to the remote binary to pull the icon.
5. That fetch triggers NTLM authentication, leaking the NTLMv2 hash straight to the attacker.

Why it hurts

• Stolen hashes feed offline cracking, relay attacks, and malware delivery.
• It fires just from viewing the shortcut. No clicks needed.

---

What an Attacker Gets

• Credential theft: NTLMv2 hashes cracked offline or relayed to gain access.
• Privilege escalation and lateral movement: Domain compromise is on the table.
• Malware delivery: Remote binaries are fetched automatically.
• Phishing bypass: The zero-click nature slips past a lot of security controls.

---

The Attack in Order

1. Host the exploit on an SMB server.
2. Craft a .lnk pointing at the SMB binary.
3. Deliver the shortcut to the victim.
4. The victim views the shortcut, and Explorer triggers the NTLM leak.
5. The attacker captures the hashes, then moves to offline cracking, relay attacks, or malware execution.

---

How to Cut It Off

• Apply Microsoft's August 2025 Patch Tuesday updates immediately.
• Disable NTLM authentication wherever you can and use Kerberos instead.
• Restrict SMB traffic from endpoints to untrusted networks.
• Monitor outbound SMB connections from explorer.exe.
• Detect suspicious .lnk files that reference UNC paths or remote executables.
• Alert on explorer.exe downloads that happen without user interaction.

That last cluster is where I'd spend my time. Outbound SMB from explorer.exe with no human in the loop is a clean, high-signal detection. If your EDR isn't watching for it, this leak runs silent. Attackers know exactly which telemetry tends to go unwatched, which is the same theme we covered in why EDR killers keep working and how deception survives them.

There's also a deception angle that detection-only teams tend to overlook. A relayed or cracked NTLMv2 hash is only useful if it opens a real door. Plant decoy accounts and Active Directory credential mines and the attacker's stolen hash becomes a tripwire: the first authentication attempt against a honeytoken account tells you the leak already happened, and exactly which host it came from. That pairs naturally with the relay-and-escalate path infostealers love, which we mapped in the credential-theft EDR-killer breakdown.

Curious how that looks in practice? Explore Mine2's deception solutions and see where the tripwires go.

---

Last Word

Never treat a single patch as the finish line. Validate your mitigations, watch your network flows, and ship critical updates fast. The credential you protect today might be the one that would have started your company's next ransomware breach.