VulnerabilityPublished 12 Nov 2024Updated 21 Oct 2025

CVE-2024-43451: Microsoft Windows Server 2025 · External Control of File Name or Path

Affects Microsoft Windows Server 2025Source CVE Database V5

Exploited in the wild · KEV due 3 Dec 2024 · public exploit available · 84% EPSS : apply the vendor's fix or mitigations to Microsoft Windows Server 2025 now.

Data as of 26 Oct 2026, 17:16 UTC

CVSS 3.1 base score

6.5Medium

How severe the flaw is on the 0–10 CVSS scale.

KEV deadline: 3 Dec 2024 US federal agencies must patch by this date; a sensible deadline for everyone else. Other KEV due dates
EPSS: 84.2% chance of exploitation in 30 days – higher than 99% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:F/RL:O/RC:C

Base metrics

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: Required
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: None

Temporal metrics

Exploit Code Maturity: Functional
Remediation Level: Official Fix
Report Confidence: Confirmed

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: Required: Successful exploitation of this vulnerability requires a user to take some action before the vulnerability can be exploited.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: High: There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact.
Integrity: None: There is no loss of integrity within the impacted component.
Availability: None: There is no impact to availability within the impacted component.
Exploit Code Maturity: Functional: Functional exploit code is available. The code works in most situations where the vulnerability exists.
Remediation Level: Official Fix: A complete vendor solution is available. Either the vendor has issued an official patch, or an upgrade is available.
Report Confidence: Confirmed: Detailed reports exist, or functional reproduction is possible (functional exploits may provide this). Source code is available to independently verify the assertions of the research, or the author or vendor of the affected code has confirmed the presence of the vulnerability.

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

t = 0 is the CVE’s publication on cve.org

Disclosed: evidence found.
CVE published 12 Nov 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: evidence found.
CVSS exploit maturity: proof of concept public
Exploited in the wildExploited: evidence found.
Listed in CISA KEV the same day as disclosure
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

CVE ID reserved
by Microsoft Corporation
14 Aug 202401:08 UTC, 90 days before disclosure
CVE published
on cve.org
12 Nov 202417:53 UTC, t = 0
Added to CISA KEV (opens in a new tab)
exploitation confirmed
12 Nov 2024, the same day as disclosure
KEV remediation due
US federal deadline
3 Dec 2024, 21 days after disclosure

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), CVSS vector, CISA KEV (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Affected software

Product	Affected	Fixed in
Microsoft Windows Server 2025	Affected =10.0.26100.0	Fixed in–

Description

NTLM Hash Disclosure Spoofing Vulnerability

Impact

The primary impact of CVE-2024-43451 is the potential disclosure of NTLM authentication hashes, which can be leveraged by attackers to impersonate users or conduct relay attacks, undermining the confidentiality of authentication credentials. This can lead to unauthorized access to sensitive systems and data, especially in environments relying heavily on NTLM authentication. Although integrity and availability are not directly affected, the compromise of authentication credentials can facilitate further attacks that may impact these aspects. Organizations running Windows Server 2025 in critical roles such as domain controllers, file servers, or application servers are particularly at risk. The vulnerability's requirement for user interaction and network accessibility broadens the attack surface, especially in environments with remote users or exposed services. The absence of known exploits currently limits immediate risk, but the medium severity score and potential for credential theft warrant proactive mitigation to prevent escalation and lateral movement within networks.

Mitigation

1. Monitor official Microsoft channels closely for patches or security advisories addressing CVE-2024-43451 and apply updates promptly once available. 2. Implement strict network segmentation and limit exposure of Windows Server 2025 systems to untrusted networks to reduce attack surface. 3. Enforce strong user awareness training to minimize risky user interactions that could trigger exploitation, such as opening suspicious files or links. 4. Disable or restrict NTLM authentication where possible, transitioning to more secure authentication protocols like Kerberos to reduce reliance on vulnerable NTLM hashes. 5. Employ network-level protections such as SMB signing and encryption to mitigate interception or manipulation of authentication traffic. 6. Use endpoint detection and response (EDR) tools to monitor for unusual file path manipulations or suspicious authentication activities indicative of exploitation attempts. 7. Regularly audit and harden file system permissions to prevent unauthorized external control of file paths. 8. Consider deploying application whitelisting and restricting execution of untrusted code to limit exploitation vectors. These measures collectively reduce the likelihood and impact of exploitation beyond generic patching advice.

CWE-73External Control of File Name or Path (opens in a new tab)
Base weaknessLikelihood of exploit: HighOWASP Top 10 A06:2025: Insecure Design (opens in a new tab)
The product allows user input to control or influence paths or file names that are used in filesystem operations.
Architecture and Design
When the set of filenames is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames, and reject all other inputs. For example, ID 1 could map to "inbox.txt" and ID 2 could map to "profile.txt".
Architecture and Design · Operation
Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict all access to files within a particular directory.
Architecture and Design
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks…
OWASP Cheat Sheets
XML Security (opens in a new tab)
Mass Assignment (opens in a new tab)
Secure Design Principles (opens in a new tab)
OWASP ASVS 4.0.3
V12.3.2 (opens in a new tab)
V13.3.1 (opens in a new tab)
V5.1.4 (opens in a new tab)
Attack patterns
Subverting Environment Variable Values (opens in a new tab)
Leverage Alternate Encoding (opens in a new tab)
Using Slashes and URL Encoding Combined to Bypass Validation Logic (opens in a new tab)
URL Encoding (opens in a new tab)
Manipulating Web Input to File System Calls (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

Timeline

What to do

Affected software

Description

AI analysisMachine-generated, updated 28 Feb 2026, 06:29 UTC

WeaknessesCWE-73

Technical details

References

Community reviews

Related threats