# CVE-2026-24294: NTLM Reflection Bypass via SMB on Arbitrary TCP Ports — Local Privilege Escalation to SYSTEM

> Microsoft Windows Server 2025 and Windows 11 24H2+ are vulnerable to NTLM reflection attacks exploiting SMB connectivity on non-standard TCP ports. A working proof-of-concept using Impacket and modified PetitPotam allows attackers to coerce privileged services to authenticate to attacker-controlled SMB servers, relay captured NTLM credentials, and achieve SYSTEM-level privilege escalation on vulnerable systems by default.

- **Published:** 2026-06-30T00:00:00Z
- **Last reviewed:** 2026-06-30T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1007
- **ID:** TL-2026-1007
- **Severity:** CRITICAL (CVSS 7.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 22 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-24294

## Description

CVE-2026-24294 is an improper authentication vulnerability in the Windows SMB Server (CWE-287) that allows attackers to bypass Microsoft's prior NTLM reflection mitigations. The vulnerability stems from a feature introduced in Windows 11 24H2 and Windows Server 2025 that permits SMB client connections over arbitrary TCP ports rather than the traditional port 445. This capability was designed to increase flexibility for SMB deployments but created a new attack surface for local NTLM reflection attacks.

The attack chain works in two main stages. In the first stage, an attacker with local access starts a malicious SMB server listening on a non-standard port (such as 12345) and mounts a network share using the new /tcpport parameter: `net use \\127.0.0.1\share /tcpport:12345`. This forces the Windows SMB client to establish and maintain a TCP connection to the attacker's local server. Due to SMB multiplexing capabilities, multiple authenticated sessions can reuse the same TCP connection, and Windows preferentially reuses existing connections rather than creating new ones.

In the second stage, the attacker coerces a privileged service such as LSASS (Local Security Authority Subsystem Service), running as NT AUTHORITY\SYSTEM, to access the same share path. This coercion is achieved using modified PetitPotam-style authentication coercion primitives. The SMB client then authenticates to the attacker's local SMB server over the pre-established connection, performing local NTLM authentication because the target effectively resolves to the same machine (127.0.0.1). The attacker captures this SYSTEM-level NTLM authentication and relays it back to the legitimate SMB service on the host using Impacket's ntlmrelayx tool, resulting in a SYSTEM-authenticated SMB session and full local compromise.

The vulnerability is enabled by default on Windows Server 2025 and affects all Windows 10 versions (1607 through 22H2), Windows 11 versions (23H2, 24H2, 25H2, 26H1), and all Windows Server versions from 2012 through 2025. SMB signing enforcement can mitigate the attack on some systems such as Windows 11 24H2, where signing is mandatory. Microsoft released a patch in the March 2026 Patch Tuesday release (KB5034567 and related articles) that restricts SMB client connections on non-standard ports or implements additional authentication integrity checks.

## MITRE ATT&CK

- T1078.001 Default Accounts
- T1059 Command and Scripting Interpreter
- T1136 Create Account
- T1548 Abuse Elevation Control Mechanism
- T1548.002 Bypass User Account Control
- T1556 Modify Authentication Process
- T1550 Use Alternate Authentication Material
- T1003 OS Credential Dumping
- T1187 Forced Authentication
- T1040 Network Sniffing
- T1558 Steal or Forge Kerberos Tickets
- T1087 Account Discovery
- T1570 Lateral Tool Transfer
- T1210 Exploitation of Remote Services
- T1071 Application Layer Protocol
- T1563 Remote Service Session Hijacking
- T1496 Resource Hijacking
- T1561 Disk Wipe
- T1589.001 Credentials
- T1583 Acquire Infrastructure
- T1587 Develop Capabilities
- T1588 Obtain Capabilities

## Sources

- [PoC Released for NTLM Reflection Bypass Flaw that Enables SYSTEM Access on Windows Server](https://cybersecuritynews.com/poc-released-for-ntlm-reflection-bypass-flaw/)
- [Bypassing Windows Authentication Reflection Mitigations for SYSTEM shells - Part 1](https://www.synacktiv.com/publications/bypassing-windows-authentication-reflection-mitigations-for-system-shells-part-1)
- [Microsoft Security Response Center: CVE-2026-24294 Vulnerability Guide](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24294)
- [NVD CVE-2026-24294 Details and Affected Software](https://nvd.nist.gov/vuln/detail/CVE-2026-24294)
- [Vicarius CVE-2026-24294 Detection Script](https://www.vicarius.io/vsociety/posts/cve-2026-24294-detection-script-improper-authentication-vulnerability-in-windows-smb-server)
- [Vicarius CVE-2026-24294 Mitigation Script](https://www.vicarius.io/vsociety/posts/cve-2026-24294-mitigation-script-improper-authentication-vulnerability-in-windows-smb-server)
- [GitHub: CVE-2026-24294 Public PoC by 0xNDI](https://github.com/0xNDI/CVE-2026-24294)
- [Microsoft Windows Server SMB Arbitrary Port Feature Documentation](https://learn.microsoft.com/en-us/windows-server/storage/file-server/smb-ports)
- [James Forshaw - Windows Exploitation Tricks: Trapping with Delayed SMB](https://projectzero.google/2025/01/windows-exploitation-tricks-trapping.html)
- [CVE-2025-33073: Prior NTLM Reflection Vulnerability (March 2025 Patch)](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-33073)
- [Windows Credential Target Information (CMTI) Technique Documentation](https://learn.microsoft.com/en-us/windows/win32/api/wincred/ns-wincred-credential_target_informationw)
- [NTLM Authentication: Local Authentication Technical Details](https://davenport.sourceforge.net/ntlm.html)
- [PetitPotam - Coercion Primitives for Windows Authentication](https://github.com/topotam/PetitPotam)
- [Impacket ntlmrelayx - NTLM Relay Tool](https://github.com/SecureAuthCorp/impacket)
- [SMB Signing Enforcement - Group Policy Configuration](https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-security-require-signature-or-seal-on-incoming-smb-traffic)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1007