CVE-2025-33053 is a zero-day remote code execution vulnerability in Windows Web Distributed Authoring and Versioning (WebDAV). It was actively exploited in the wild by the Stealth Falcon APT group and patched by Microsoft in June 2025.
This vulnerability allows remote attackers to execute arbitrary code on affected systems by tricking users into clicking on a specially crafted WebDAV URL.
CVE-2025-33053 was exploited in the wild by the Stealth Falcon APT group. The attack involved tricking users into clicking on a specially crafted WebDAV URL, which would then execute arbitrary code on the victim's system.
This vulnerability was used in targeted attacks, allowing the APT group to gain a foothold on compromised systems and deploy additional malware or tools for espionage purposes.
Microsoft released security updates for this vulnerability as part of the June 2025 Patch Tuesday. Users and administrators are strongly advised to apply the update immediately to prevent exploitation.
For systems that cannot be patched, Microsoft recommends disabling the WebDAV service if it is not required, and exercising caution when clicking on untrusted URLs.