CVE-2025-55234 is a high severity weakness in Windows SMB Server that can leave users open to relay attacks and privilege elevation, depending on configuration. Microsoft shipped audit capabilities in the September 2025 security updates and advises turning on SMB signing and Extended Protection for Authentication after assessing compatibility.
What's affected
- Product: Windows SMB Server on Windows 10 (1507, 1607, 1809, 21H2, 22H2) and Windows 11 (22H2, 23H2, 24H2), per the record.
- Condition: the issue depends on configuration. Servers that already enforce SMB signing and EPA are protected against these relay attacks.
- What shipped: Microsoft says it is releasing this CVE to provide audit capabilities, so you can find devices or software that would break before you turn on hardening. The audit events came with the September 2025 security updates.
This is unusual because the update is not a simple fix. It is a way to prepare for enforcing hardening that already exists in the product. Enabling signing or EPA without testing can break older clients and devices that cannot meet the requirement, which is why Microsoft recommends the audit step first.
The record's references include community detection and mitigation scripts from a third party vendor. Treat third party scripts like any other code you did not write: read them and test before running them on production machines. Check Microsoft's update guide entry for the current details.
How to check if you're exposed
First, check that the September 2025 or later cumulative update is installed.
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5
Then check whether SMB signing is required on the server.
Get-SmbServerConfiguration | Select-Object RequireSecuritySignature, EnableSecuritySignature
If RequireSecuritySignature is False, the server does not require signing. After that, use the audit events Microsoft describes, which log clients that would fail if signing or EPA were enforced. Collect events for a representative period, such as a full business cycle, before changing enforcement. Follow Microsoft's guidance for EPA settings, since the steps depend on your environment.
What to do now
- Install the September 2025 security updates, or a later cumulative update, on affected Windows 10 and 11 systems.
- Turn on the SMB Server audit events described by Microsoft for signing and EPA.
- Review the audit results, and fix or replace clients and devices that cannot meet the requirements.
- Enforce SMB signing, then EPA, on servers once the audit is clean, starting with a pilot group.
- Limit SMB exposure: block it at the perimeter, and restrict which hosts can reach file servers internally.
Why it matters
The weakness is improper authentication, in the sense that a relayed authentication exchange can be accepted as if the attacker were the user. In a relay attack, the attacker sits between a victim and a server, passes the victim's authentication through to a different server, and gains whatever access the victim has there. Signing and EPA bind the exchange to the real connection so a relayed copy fails.
The record needs user interaction, which fits a scenario where a victim is lured into authenticating to a hostile system. Hardening works only when it is enforced, and legacy clients are the usual reason it is postponed. The audit step turns that argument into a list of specific systems to fix. The CVE is not on the CISA KEV list.
The weakness is classed as CWE-287 (Improper Authentication). Severity in the CVE record: high, CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
Try it yourself
Configuration-dependent issues need tracking over weeks, not a one time patch. This demo shows a vulnerability workflow.
Click through it at your own pace, or open it full screen.
Quick check
Does installing the update fix the issue?
It adds audit capabilities. Microsoft says you still need to adopt SMB Server signing and EPA after assessing compatibility.
Why audit first?
Enforcing signing or EPA can break clients and software that do not support them. The audit events show what would break before you switch enforcement on.
Sources
- Microsoft Security Response Center entry for CVE-2025-55234 (listed in the CVE record; the page needs scripts, so the text above comes from the CVE record)
- Vicarius detection script post (listed in the CVE record, not fetched)
Last reviewed: 18 October 2026.
