Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Windows Standards-Based Storage Management Service Can Be Crashed by Malicious Input

CVE-2025-33068 · published 1 year ago
Summary

An attacker can send malicious data to the Windows Standards-Based Storage Management Service, causing it to consume excessive resources and potentially become unresponsive. This could impact the availability of connected storage devices and network services. To protect against this, ensure that the service is configured correctly and that firewalls are in place to block unauthorized access.

What to do
  • Update microsoft windows_server_2016 to version 10.0.14393.8148 or later.
  • Update microsoft windows_server_2019 to version 10.0.17763.7434 or later.
  • Update microsoft windows_server_2022 to version 10.0.20348.3745 or later.
  • Update microsoft windows_server_2025 to version 10.0.26100.4270 or later.
Affected software
VendorProductAffected versions
microsoft windows_server_2012 r2
cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*
microsoft windows_server_2016 < 10.0.14393.8148
cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*
microsoft windows_server_2019 < 10.0.17763.7434
cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*
microsoft windows_server_2022 < 10.0.20348.3745
cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*
microsoft windows_server_2025 < 10.0.26100.4270
cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*
Original advisory text
Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service over a network.
Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service over a network.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
7.5 High
Exploitation
2% chance of attack within 30 days
Type
CWE-400Uncontrolled Resource Consumption
Timeline
Published10 Jun 2025
Updated3 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-33068 · NVD
Track software like this
Free during beta