#Windows SMB

**Are there any further actions I need to take to be protected from relay attacks?** The security updates released on September 9, 2025 enable support for auditing SMB client compatibility for SMB Server signing as well as SMB Server EPA. This allows customers to assess their environment and identify any potential device or software incompatibility issues before deploying the hardening measures that are already supported by SMB Server. Please see https://support.microsoft.com/help/5066913 for more information.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB allows an unauthorized attacker to execute code over a network.

Improper certificate validation in Windows SMB allows an authorized attacker to perform spoofing over a network.

Improper access control in Windows SMB allows an authorized attacker to elevate privileges over a network.

**What privileges could be gained by an attacker who successfully exploited this vulnerability?** An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.

Buffer over-read in Windows Kernel allows an authorized attacker to disclose information over a network.

**What kind of security feature could be bypassed by successfully exploiting this vulnerability?** An attacker who successfully exploited this vulnerability could execute RPC procedures that are restricted to privileged accounts, bypassing the access check for the RPC procedures.

**What kind of security feature could be bypassed by successfully exploiting this vulnerability?** An attacker who successfully exploited this vulnerability could execute RPC procedures that are restricted to privileged accounts, bypassing the access check for the RPC procedures.

**What version of Windows Server 2022 is affected by this vulnerability?** This vulnerability only affects the hotpatch version of Windows Server 2022. If you are not running this version of the operating system, no action is required for this vulnerability.

**Why is this Rapid7 CVE included in the Security Update Guide?** The vulnerability assigned to this CVE was originally classified as a stability bug in Windows. Rapid7 discovered that this bug could be used to cause a denial of service condition on affected versions of Windows. Microsoft had provided an update to address this issue prior to being contacted about it by Rapid 7. Microsoft appreciates the strong partnership that we have with Rapid7. **Why are the May updates associated with the operating systems rows in the Security Updates table?** This vulnerability was addressed in the May 2022 security updates.