CVE-2025-33053: listed in the CISA KEV catalog

CVE-2025-33053 · CVSS 8.8 HIGH · EPSS 85% · KEV 2025-06-10

External control of file name or path in Internet Shortcut Files allows an unauthorized attacker to execute code over a network.

Is CVE-2025-33053 exploited?

• Listed in the CISA KEV catalog on 2025-06-10.
• Federal remediation due 2025-07-01.
• Past that date by 410 days.
• EPSS puts exploitation in the next 30 days at 85%.
• Public exploit code: packaged in a public tool.

Which products and versions are affected?

No affected package list recorded here yet.

Is there a patch?

No patch identifier recorded here yet.

What PlainSec published about CVE-2025-33053

• AI-Labeled Phishing Pipeline Is Already in Production (2026-07-21)

Primary sources

• NVD record
• CISA KEV catalog
• Metasploit: exploit/windows/fileformat/unc_url_cve_2025_33053

What this record does not say

• No affected package data.
• No patch identifier.

KEV and EPSS are re-checked daily. Record last updated 2026-08-11.