CVE-2026-20925 - Vulnerability Details

- NTLM Hash Disclosure Spoofing Vulnerability

Description

External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.

Published: 2026-01-13

Score: 6.5 Medium

EPSS: 17.3% Moderate

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability arises from external control of the file name or path used during Windows NTLM authentication. This is a CWE‑73 flaw. An attacker who can supply an arbitrary file name or path may cause the system to accept forged NTLM messages, effectively spoofing the authentication process over a network.

Affected Systems

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 22H3; Windows Server 2008 R2 SP1, 2008 SP2, 2012, 2012 R2, 2016, 2019, 2022, and 2025 (including Server Core installations).

Risk and Exploitability

The CVSS score of 6.5 indicates a moderate severity, and the EPSS score of 17% indicates a relatively higher likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. This weakness is classified as CWE‑73, indicating external control of the file name or path used in NTLM authentication. Likely attack vectors involve a network‑based attacker who initiates or intercepts NTLM authentication exchanges, supplying a crafted file name or path to influence the authentication sequence.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Microsoft

Windows 10 Version 1607

affected

Version	Status	Constraints
`10.0.14393.0`	affected	< 10.0.14393.8783

Microsoft

Windows 10 Version 1809

affected

Version	Status	Constraints
`10.0.17763.0`	affected	< 10.0.17763.8276

Microsoft

Windows 10 Version 21H2

affected

Version	Status	Constraints
`10.0.19044.0`	affected	< 10.0.19044.6809

Microsoft

Windows 10 Version 22H2

affected

Version	Status	Constraints
`10.0.19045.0`	affected	< 10.0.19045.6809

Microsoft

Windows 11 version 22H3

affected

Version	Status	Constraints
`10.0.22631.0`	affected	< 10.0.22631.6491

Microsoft

Windows 11 Version 23H2

affected

Version	Status	Constraints
`10.0.22631.0`	affected	< 10.0.22631.6491

Microsoft

Windows 11 Version 24H2

affected

Version	Status	Constraints
`10.0.26100.0`	affected	< 10.0.26100.7623

Microsoft

Windows 11 Version 25H2

affected

Version	Status	Constraints
`10.0.26200.0`	affected	< 10.0.26200.7623

Microsoft

Windows Server 2008 R2 Service Pack 1

affected

Version	Status	Constraints
`6.1.7601.0`	affected	< 6.1.7601.28117

Microsoft

Windows Server 2008 R2 Service Pack 1 (Server Core installation)

affected

Version	Status	Constraints
`6.1.7601.0`	affected	< 6.1.7601.28117

Microsoft

Windows Server 2008 Service Pack 2

affected

Version	Status	Constraints
`6.0.6003.0`	affected	< 6.0.6003.23717

Microsoft

Windows Server 2008 Service Pack 2 (Server Core installation)

affected

Version	Status	Constraints
`6.0.6003.0`	affected	< 6.0.6003.23717

Microsoft

Windows Server 2012

affected

Version	Status	Constraints
`6.2.9200.0`	affected	< 6.2.9200.25868

Microsoft

Windows Server 2012 (Server Core installation)

affected

Version	Status	Constraints
`6.2.9200.0`	affected	< 6.2.9200.25868

Microsoft

Windows Server 2012 R2

affected

Version	Status	Constraints
`6.3.9600.0`	affected	< 6.3.9600.22968

Microsoft

Windows Server 2012 R2 (Server Core installation)

affected

Version	Status	Constraints
`6.3.9600.0`	affected	< 6.3.9600.22968

Microsoft

Windows Server 2016

affected

Version	Status	Constraints
`10.0.14393.0`	affected	< 10.0.14393.8783

Microsoft

Windows Server 2016 (Server Core installation)

affected

Version	Status	Constraints
`10.0.14393.0`	affected	< 10.0.14393.8783

Microsoft

Windows Server 2019

affected

Version	Status	Constraints
`10.0.17763.0`	affected	< 10.0.17763.8276

Microsoft

Windows Server 2019 (Server Core installation)

affected

Version	Status	Constraints
`10.0.17763.0`	affected	< 10.0.17763.8276

Microsoft

Windows Server 2022

affected

Version	Status	Constraints
`10.0.20348.0`	affected	< 10.0.20348.4648

Microsoft

Windows Server 2022, 23H2 Edition (Server Core installation)

affected

Version	Status	Constraints
`10.0.25398.0`	affected	< 10.0.25398.2092

Microsoft

Windows Server 2025

affected

Version	Status	Constraints
`10.0.26100.0`	affected	< 10.0.26100.32230

Microsoft

Windows Server 2025 (Server Core installation)

affected

Version	Status	Constraints
`10.0.26100.0`	affected	< 10.0.26100.32230

Configuration 1 [-]

OR	cpe:2.3:o:microsoft:windows_10_1607:::::::x64:*
	cpe:2.3:o:microsoft:windows_10_1607:::::::x86:*
	cpe:2.3:o:microsoft:windows_10_1809:::::::x64:*
	cpe:2.3:o:microsoft:windows_10_1809:::::::x86:*
	cpe:2.3:o:microsoft:windows_10_21h2::::::::
	cpe:2.3:o:microsoft:windows_10_22h2::::::::
	cpe:2.3:o:microsoft:windows_11_23h2::::::::
	cpe:2.3:o:microsoft:windows_11_24h2::::::::
	cpe:2.3:o:microsoft:windows_11_25h2::::::::
	cpe:2.3:o:microsoft:windows_server_2008:-:sp2:::::x64:*
	cpe:2.3:o:microsoft:windows_server_2008:-:sp2:::::x86:*
	cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:::::x64:*
	cpe:2.3:o:microsoft:windows_server_2012:-:::::::*
	cpe:2.3:o:microsoft:windows_server_2012:r2:::::::*
	cpe:2.3:o:microsoft:windows_server_2016::::::::
	cpe:2.3:o:microsoft:windows_server_2019::::::::
	cpe:2.3:o:microsoft:windows_server_2022::::::::
	cpe:2.3:o:microsoft:windows_server_2022_23h2::::::::
	cpe:2.3:o:microsoft:windows_server_2025::::::::

No data.

No data available yet.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Install the Microsoft security update that addresses the CWE‑73 vulnerability in NTLM authentication for all affected Windows 10, Windows 11, and Windows Server releases.
Configure Group Policy to restrict or disable NTLM authentication wherever possible, thereby reducing attack surface for the CWE‑73 weakness and encouraging use of more secure protocols such as Kerberos.
Monitor NTLM authentication traffic for anomalous patterns and limit network exposure of legacy NTLM endpoints by firewall or segmentation.

Generated by OpenCVE AI on June 18, 2026 at 13:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.17312.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20925

History

Fri, 16 Jan 2026 14:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Microsoft windows 10 21h2 Microsoft windows 10 22h2 Microsoft windows 11 23h2 Microsoft windows 11 24h2 Microsoft windows 11 25h2 Microsoft windows Server 2008 Microsoft windows Server 2022 23h2
CPEs		cpe:2.3:o:microsoft:windows_10_1607:::::::x64:* cpe:2.3:o:microsoft:windows_10_1809:::::::x64:* cpe:2.3:o:microsoft:windows_10_21h2:::::::: cpe:2.3:o:microsoft:windows_10_22h2:::::::: cpe:2.3:o:microsoft:windows_11_23h2:::::::: cpe:2.3:o:microsoft:windows_11_24h2:::::::: cpe:2.3:o:microsoft:windows_11_25h2:::::::: cpe:2.3:o:microsoft:windows_server_2008:-:sp2:::::x64:* cpe:2.3:o:microsoft:windows_server_2008:-:sp2:::::x86:* cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:::::x64:* cpe:2.3:o:microsoft:windows_server_2012:-:::::::* cpe:2.3:o:microsoft:windows_server_2012:r2:::::::* cpe:2.3:o:microsoft:windows_server_2022_23h2::::::::
Vendors & Products		Microsoft windows 10 21h2 Microsoft windows 10 22h2 Microsoft windows 11 23h2 Microsoft windows 11 24h2 Microsoft windows 11 25h2 Microsoft windows Server 2008 Microsoft windows Server 2022 23h2

Wed, 14 Jan 2026 20:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 13 Jan 2026 18:15:00 +0000

Type	Values Removed	Values Added
Description		External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.
Title		NTLM Hash Disclosure Spoofing Vulnerability
First Time appeared		Microsoft Microsoft windows 10 1607 Microsoft windows 10 1809 Microsoft windows 10 21h2 Microsoft windows 10 22h2 Microsoft windows 11 23h2 Microsoft windows 11 24h2 Microsoft windows 11 25h2 Microsoft windows Server 2008 R2 Microsoft windows Server 2008 Sp2 Microsoft windows Server 2012 Microsoft windows Server 2012 R2 Microsoft windows Server 2016 Microsoft windows Server 2019 Microsoft windows Server 2022 Microsoft windows Server 2025 Microsoft windows Server 23h2
Weaknesses		CWE-73
CPEs		cpe:2.3:o:microsoft:windows_10_1607:::::::x86:* cpe:2.3:o:microsoft:windows_10_1809:::::::x86:* cpe:2.3:o:microsoft:windows_10_21H2:::::::x86:* cpe:2.3:o:microsoft:windows_10_22H2:::::::x64:* cpe:2.3:o:microsoft:windows_11_23H2:::::::arm64:* cpe:2.3:o:microsoft:windows_11_23H2:::::::x64:* cpe:2.3:o:microsoft:windows_11_24H2:::::::arm64:* cpe:2.3:o:microsoft:windows_11_25H2:::::::arm64:* cpe:2.3:o:microsoft:windows_server_2008_R2:::::::x64:* cpe:2.3:o:microsoft:windows_server_2008_sp2:::::::x64:* cpe:2.3:o:microsoft:windows_server_2012:::::::x64:* cpe:2.3:o:microsoft:windows_server_2012_R2:::::::x64:* cpe:2.3:o:microsoft:windows_server_2016:::::::: cpe:2.3:o:microsoft:windows_server_2019:::::::: cpe:2.3:o:microsoft:windows_server_2022:::::::: cpe:2.3:o:microsoft:windows_server_2025:::::::: cpe:2.3:o:microsoft:windows_server_23h2::::::::
Vendors & Products		Microsoft Microsoft windows 10 1607 Microsoft windows 10 1809 Microsoft windows 10 21h2 Microsoft windows 10 22h2 Microsoft windows 11 23h2 Microsoft windows 11 24h2 Microsoft windows 11 25h2 Microsoft windows Server 2008 R2 Microsoft windows Server 2008 Sp2 Microsoft windows Server 2012 Microsoft windows Server 2012 R2 Microsoft windows Server 2016 Microsoft windows Server 2019 Microsoft windows Server 2022 Microsoft windows Server 2025 Microsoft windows Server 23h2
References		https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20925
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C'}`

Subscriptions

Microsoft Windows 10 1607 Windows 10 1809 Windows 10 21h2 Windows 10 21h2 Windows 10 22h2 Windows 10 22h2 Windows 11 23h2 Windows 11 23h2 Windows 11 24h2 Windows 11 24h2 Windows 11 25h2 Windows 11 25h2 Windows Server 2008 Windows Server 2008 R2 Windows Server 2008 Sp2 Windows Server 2012 Windows Server 2012 R2 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2022 23h2 Windows Server 2025 Windows Server 23h2

MITRE

Status: PUBLISHED

Assigner: microsoft

Published: 2026-01-13T17:56:41.739Z

Updated: 2026-04-01T13:48:50.851Z

Reserved: 2025-12-04T20:04:16.335Z

Link: CVE-2026-20925

Vulnrichment

Updated: 2026-01-13T19:33:38.719Z

NVD

Status : Analyzed

Published: 2026-01-13T18:16:19.200

Modified: 2026-06-17T10:18:02.833

Link: CVE-2026-20925

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-06-18T14:00:16Z

Weaknesses

CWE-73
External Control of File Name or Path

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

Exploitation none

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object