Threat reportVulnerabilityTL-2026-1007
CVE-2026-24294: NTLM Reflection Bypass via SMB on Arbitrary TCP Ports — Local Privilege Escalation to SYSTEM
CVE-2026-24294 (TL-2026-1007), also tracked as NTLM Reflection Bypass, is a critical-severity software vulnerability scored CVSS 7.8, first published 2026-06-30. It has no confirmed attribution, affects Microsoft Windows 10 Version 1607, references 1 CVE (CVE-2026-24294), maps to 22 MITRE ATT&CK techniques (T1003, T1040, T1059), and is covered by 9 detection rules and 22 indicators of compromise.
- CVSS
- 7.8/10Critical
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 22MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 22Indicators of compromise
Key facts for TL-2026-1007
- Threat ID
- TL-2026-1007
- Also known as
- NTLM Reflection Bypass, SMB Arbitrary Port NTLM Relay, CVE-2026-24294 LPE
- Severity
- CRITICAL
- CVSS
- 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- NONE
- Motivation
- UNKNOWN
- Target sectors
- government administration, finance, health, education, technology, manufacturing, critical-infrastructure
- Target regions
- North America, Europe, Asia-Pacific
- Detection rules
- 9
- Indicators of compromise
- 22
Malware and tooling in CVE-2026-24294
Malware and tooling: Impacket - S0357, Net - S0039, PetitPotam
How CVE-2026-24294 works
Microsoft Windows Server 2025 and Windows 11 24H2+ are vulnerable to NTLM reflection attacks exploiting SMB connectivity on non-standard TCP ports. A working proof-of-concept using Impacket and modified PetitPotam allows attackers to coerce privileged services to authenticate to attacker-controlled SMB servers, relay captured NTLM credentials, and achieve SYSTEM-level privilege escalation on vulnerable systems by default.
CVE-2026-24294 is an improper authentication vulnerability in the Windows SMB Server (CWE-287) that allows attackers to bypass Microsoft's prior NTLM reflection mitigations. The vulnerability stems from a feature introduced in Windows 11 24H2 and Windows Server 2025 that permits SMB client connections over arbitrary TCP ports rather than the traditional port 445. This capability was designed to increase flexibility for SMB deployments but created a new attack surface for local NTLM reflection attacks.
The attack chain works in two main stages. In the first stage, an attacker with local access starts a malicious SMB server listening on a non-standard port (such as 12345) and mounts a network share using the new /tcpport parameter: `net use \\127.0.0.1\share /tcpport:12345`. This forces the Windows SMB client to establish and maintain a TCP connection to the attacker's local server. Due to SMB multiplexing capabilities, multiple authenticated sessions can reuse the same TCP connection, and Windows preferentially reuses existing connections rather than creating new ones.
In the second stage, the attacker coerces a privileged service such as LSASS (Local Security Authority Subsystem Service), running as NT AUTHORITY\SYSTEM, to access the same share path. This coercion is achieved using modified PetitPotam-style authentication coercion primitives. The SMB client then authenticates to the attacker's local SMB server over the pre-established connection, performing local NTLM authentication because the target effectively resolves to the same machine (127.0.0.1). The attacker captures this SYSTEM-level NTLM authentication and relays it back to the legitimate SMB service on the host using Impacket's ntlmrelayx tool, resulting in a SYSTEM-authenticated SMB session and full local compromise.
The vulnerability is enabled by default on Windows Server 2025 and affects all Windows 10 versions (1607 through 22H2), Windows 11 versions (23H2, 24H2, 25H2, 26H1), and all Windows Server versions from 2012 through 2025. SMB signing enforcement can mitigate the attack on some systems such as Windows 11 24H2, where signing is mandatory. Microsoft released a patch in the March 2026 Patch Tuesday release (KB5034567 and related articles) that restricts SMB client connections on non-standard ports or implements additional authentication integrity checks.
MITRE ATT&CK techniques used in TL-2026-1007
Credential Access
T1003 OS Credential Dumping; T1040 Network Sniffing; T1187 Forced Authentication; T1558 Steal or Forge Kerberos Tickets
Execution
T1059 Command and Scripting Interpreter
Command and Control
T1071 Application Layer Protocol
Initial Access
Discovery
Persistence
Lateral Movement
T1210 Exploitation of Remote Services; T1570 Lateral Tool Transfer
Impact
T1496 Resource Hijacking; T1561 Disk Wipe
Privilege Escalation
T1548 Abuse Elevation Control Mechanism; T1548.002 Bypass User Account Control
lateral-movement
T1550 Use Alternate Authentication Material; T1563 Remote Service Session Hijacking
defense-impairment
T1556 Modify Authentication Process
Resource Development
T1583 Acquire Infrastructure; T1587 Develop Capabilities; T1588 Obtain Capabilities
Reconnaissance
Affected products and versions in CVE-2026-24294
- Microsoft — Windows 10 Version 1607
Vulnerable versions: RTM through KB4000000
Fixed in: 10.0.14393.8957 and later - Microsoft — Windows 10 Version 1809
Vulnerable versions: RTM through update
Fixed in: 10.0.17763.8511 and later - Microsoft — Windows 10 Version 21H2
Vulnerable versions: all versions
Fixed in: 10.0.19044.7058 and later - Microsoft — Windows 10 Version 22H2
Vulnerable versions: all versions
Fixed in: 10.0.19045.7058 and later - Microsoft — Windows 11 Version 23H2
Vulnerable versions: 10.0.22631.0 through 10.0.22631.6782
Fixed in: 10.0.22631.6783 and later - Microsoft — Windows 11 Version 24H2
Vulnerable versions: 10.0.26100.0 through 10.0.26100.7978
Fixed in: 10.0.26100.7979 and later - Microsoft — Windows 11 Version 25H2
Vulnerable versions: 10.0.26200.0 through 10.0.26200.7978
Fixed in: 10.0.26200.7979 and later - Microsoft — Windows 11 Version 26H1
Vulnerable versions: 10.0.28000.0 through 10.0.28000.1718
Fixed in: 10.0.28000.1719 and later - Microsoft — Windows Server 2012
Vulnerable versions: all versions
Fixed in: 6.2.9200.25973 and later - Microsoft — Windows Server 2012 R2
Vulnerable versions: all versions
Fixed in: 6.3.9600.23074 and later
Remediation for CVE-2026-24294
Patches
- Windows Server 2025: KB5034567 and later
- Windows 11 24H2: KB5034567 (or equivalent)
- Windows 11 23H2: Security update released March 2026
- Windows 11 25H2/26H1: March 2026 cumulative updates
- Windows Server 2022/23H2: KB5034567
- Windows 10: All versions require March 2026 Patch Tuesday updates
Immediate actions
- Apply Microsoft March 2026 Patch Tuesday security updates to all affected systems
- Enforce SMB signing on all Windows systems (Group Policy: Network security: Require signature or seal on incoming SMB traffic)
- Disable or restrict use of the /tcpport parameter for SMB connections if not required
- Monitor for unusual SMB traffic on non-standard TCP ports (not 445) in network telemetry
- Restrict local network access to privileged services and monitor for coercion attempts
Workarounds
- Enforce mandatory SMB signing via Group Policy before patching
- Disable user ability to mount SMB shares on arbitrary ports via Group Policy restrictions
- Restrict local account access and enforce multi-factor authentication for privileged accounts
- Implement network segmentation to limit local attacker reach
Longer-term hardening
- Deploy EDR solutions with behavioral detection for NTLM relay attack patterns
- Implement Windows Defender for Endpoint (MDE) with attack surface reduction rules
- Consider migrating authentication infrastructure to Kerberos-only environments where feasible
- Implement strict NTLM deprecation policies and disable NTLM for inter-server communications
- Enable Windows Firewall rules restricting SMB to necessary internal networks only
- Deploy NTLM relay detection via network segmentation and DNS monitoring
CVEs associated with CVE-2026-24294
Weaknesses (CWE) in CVE-2026-24294
Timeline of CVE-2026-24294
- CVE-2025-33073 published and patched by Microsoft, addressing NTLM reflection via SMB client using credential marshaling technique (CMTI)
- Synacktiv researchers begin investigation into bypass methods for CVE-2025-33073 mitigations, recognizing that Microsoft's fix is narrowly scoped
- Synacktiv discovers and analyzes Windows 11 24H2 / Windows Server 2025 feature allowing SMB client connections on arbitrary TCP ports
- Synacktiv team develops working proof-of-concept exploit using Impacket smbserver.py, ntlmrelayx, modified PetitPotam, and Windows net.exe commands
- CVE-2026-24294 vulnerability confirmed: NTLM reflection bypass via SMB on arbitrary TCP ports on Windows Server 2025 and Windows 11 24H2
- Microsoft publishes fix for CVE-2026-24294 in March 2026 Patch Tuesday release, addressing SMB client arbitrary port connections
- Synacktiv publishes detailed technical research article 'Bypassing Windows Authentication Reflection Mitigations for SYSTEM' describing the vulnerability and exploitation techniques
- SSVC rating indicates 'active' exploitation status with public PoC available; penetration testers and threat actors likely to adopt this technique
- Vicarius and other security vendors release detection scripts and mitigation tools to identify and remediate vulnerable Windows systems
- Public proof-of-concept exploit released on GitHub by 0xNDI and security researchers; CyberSecurityNews publishes comprehensive writeup
- Industry threat intelligence reports flag CVE-2026-24294 as critical for internal network security due to zero-interaction SYSTEM privilege escalation
Sources cited for CVE-2026-24294
- PoC Released for NTLM Reflection Bypass Flaw that Enables SYSTEM Access on Windows Server
- Bypassing Windows Authentication Reflection Mitigations for SYSTEM shells - Part 1
- Microsoft Security Response Center: CVE-2026-24294 Vulnerability Guide
- NVD CVE-2026-24294 Details and Affected Software
- Vicarius CVE-2026-24294 Detection Script
- Vicarius CVE-2026-24294 Mitigation Script
- GitHub: CVE-2026-24294 Public PoC by 0xNDI
- Microsoft Windows Server SMB Arbitrary Port Feature Documentation
- James Forshaw - Windows Exploitation Tricks: Trapping with Delayed SMB
- CVE-2025-33073: Prior NTLM Reflection Vulnerability (March 2025 Patch)
- Windows Credential Target Information (CMTI) Technique Documentation
- NTLM Authentication: Local Authentication Technical Details
- PetitPotam - Coercion Primitives for Windows Authentication
- Impacket ntlmrelayx - NTLM Relay Tool
- SMB Signing Enforcement - Group Policy Configuration
Detection coverage for TL-2026-1007
As of 2026-06-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1007 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.