ExploitPublished 18 Aug 2025

Microsoft Windows 10.0.19045 · NTLMv2 Hash Disclosure

Source Exploit-DB RSS Feed

Severity

Medium

Rated by Threat Radar

Data as of 15 Nov 2025, 23:42 UTC

What to do

AI-suggested

European organizations should immediately audit their Windows 10 systems to identify those running version 10.0.19045 and assess NTLM usage. Disabling NTLM authentication entirely is the most effective mitigation; if not feasible, restrict NTLM usage to essential systems only and enforce SMB signing to prevent man-in-the-middle attacks. Implement network segmentation to limit the spread of compromised credentials and monitor network traffic for unusual NTLM authentication attempts or hash captures. Deploy multi-factor authentication (MFA) to reduce the impact of credential theft. Regularly update and patch Windows systems as vendors release fixes. Employ intrusion detection systems capable of identifying NTLM relay or hash capture attempts. Educate IT staff about this vulnerability and the risks of NTLM authentication. Consider deploying endpoint detection and response (EDR) tools to detect lateral movement and suspicious authentication behaviors. Finally, review and harden Group Policy settings related to authentication protocols.

Description

Microsoft Windows 10.0.19045 - NTLMv2 Hash Disclosure

Impact

For European organizations, this vulnerability poses a significant risk to the confidentiality and integrity of user credentials. Disclosure of NTLMv2 hashes can facilitate credential replay and brute-force attacks, potentially allowing attackers to impersonate legitimate users and gain unauthorized access to sensitive systems and data. This can lead to lateral movement within corporate networks, data breaches, and disruption of critical services. Organizations relying on legacy authentication protocols or lacking strict network segmentation are especially vulnerable. The exploit's remote nature and lack of required authentication increase the attack surface, making it easier for threat actors to target European enterprises. Critical sectors such as finance, government, healthcare, and energy, which heavily depend on Windows infrastructure, could face operational disruptions and data compromise. The absence of known exploits in the wild currently reduces immediate risk but does not eliminate the threat, especially given the public availability of exploit code.

Indicators of compromise

Exploit source code

Exploit code for Microsoft Windows 10.0.19045 - NTLMv2 Hash Disclosure2,257 characters

# Exploit Title: Microsoft Windows 10.0.19045 - NTLMv2 Hash Disclosure
# Date: 13/08/2025
# Exploit Author: Ruben Enkaoua
# Author link: https://x.com/RubenLabs, https://github.com/rubenformation
# Original Blog: https://cymulate.com/blog/zero-click-one-ntlm-microsoft-security-patch-bypass-cve-2025-50154/
# Vendor Homepage: https://microsoft.com
# Software Link: https://www.microsoft.com/en-us/software-download
# Version: All versions prior to patch tuesday august 2025
# Tested on: Windows 10.0.…

References

Community reviews

Loading reviews…