Threat reportVulnerabilityTL-2026-4866
Windows Authentication Reflection Mitigation Bypasses for SYSTEM Shells via Kerberos Unicode Coercion (CVE-2025-33073, CVE-2026-24294, CVE-2025-58726, CVE-2026-26128)
Windows Authentication Reflection Mitigation Bypasses for (TL-2026-4866), also tracked as Reflective Kerberos Relay Attack, is a high-severity software vulnerability scored CVSS 8.8, first published 2026-10-31. It has no confirmed attribution, affects Microsoft Windows SMB Client/Server (CVE-2025-33073), references 4 CVEs (CVE-2025-33073, CVE-2026-24294, CVE-2025-58726), maps to 14 MITRE ATT&CK techniques (T1018, T1021.002, T1046), and is covered by 9 detection rules and 16 indicators of compromise.
- CVSS
- 8.8/10High
- CVEs
- 4Referenced vulnerabilities
- Techniques
- 14MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 16Indicators of compromise
Key facts for TL-2026-4866
- Threat ID
- TL-2026-4866
- Also known as
- Reflective Kerberos Relay Attack, Unicode Kerberos Coercion
- Severity
- HIGH
- CVSS
- 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, finance, health, technology, manufacturing, education
- Target regions
- North America, Europe, Asia Pacific, Global
- Detection rules
- 9
- Indicators of compromise
- 16
Malware and tooling in Windows Authentication Reflection Mitigation Bypasses for
Malware and tooling: Impacket ntlmrelayx.py, Impacket smbserver.py, PetitPotam, dnstool.py, krbrelayx.py, mitm6
How Windows Authentication Reflection Mitigation Bypasses for works
Synacktiv research (Part 2, published 2026-04-30) documents a Kerberos coercion technique that registers DNS records using look-alike Unicode characters so that the DNS client treats the name as distinct from the local host while the domain controller still issues a valid Kerberos service ticket for the real machine account. The technique chains with coercion tools to achieve authenticated RCE as a domain user and local privilege escalation to SYSTEM, building on an insufficient initial fix for CVE-2025-33073 (listed in the CISA KEV catalog as exploited in the wild).
Windows has layered several defenses against authentication reflection, where a host's own coerced authentication is relayed back to itself to obtain SYSTEM privileges. Synacktiv researcher Guillaume Andre published two related analyses in 2026 showing these defenses can still be bypassed, and that Microsoft's original patch for CVE-2025-33073 treated a symptom rather than the underlying design issue.
Part 1 (published 2026-04-27) covers CVE-2025-33073 and the follow-on CVE-2026-24294. The original CVE-2025-33073 fix modified the Windows SMB client driver (mrxsmb.sys) to reject SMB sessions carrying additional target information used in relay attacks. Part 1 shows this can be bypassed by abusing SMB connection multiplexing, a feature introduced with Windows 11 24H2 and Windows Server 2025: the WNetAddConnection4W API accepts a custom TCP port through an undocumented buffer. An attacker stands up a local SMB listener on a non-default port, coerces a privileged local service into authenticating to that listener, and relays the resulting credential material to the genuine SMB service for local privilege escalation to SYSTEM. Windows Server 2025 is described as vulnerable by default; Windows 11 24H2 is not, because it enforces SMB signing more broadly. CVE-2026-24294 was addressed in the March 2026 Patch Tuesday.
Part 2 (published 2026-04-30) generalizes the bypass to Kerberos and introduces the Unicode-substitution DNS coercion technique that is the primary subject of this record. Windows components normalize Unicode strings inconsistently: LDAP name resolution inside Active Directory (via LCMapStringEx with flags including NORM_IGNOREWIDTH and NORM_IGNORECASE) folds visually similar characters -- for example the circled Latin capital letter R (U+24C7) in place of ASCII 'R', or the Unicode one-dot leader (U+2024) in place of a period -- into the same sort key as the canonical ASCII hostname. The Windows DNS client cache service, however, compares strings with CompareStringW using only NORM_IGNORECASE, so a name such as SRV1 with the R replaced by U+24C7 and dots replaced by U+2024 compares as NOT equal to the real 'SRV1.AD.LOCAL' and triggers an independent DNS lookup.
An attacker abuses this gap by: (1) registering a DNS record for the Unicode look-alike name pointing at an attacker-controlled relay host, using an LDAP-based DNS registration tool (dnstool.py); (2) coercing a target machine (via PetitPotam or a similar coercion primitive) to authenticate to the Unicode look-alike name instead of its own real FQDN; (3) when the target's Kerberos client builds a TGS-REQ for a service principal name built from the look-alike string, the domain controller's LDAP-based account lookup folds the Unicode variant back onto the real 'SRV1$' machine account and issues a legitimate Kerberos service ticket for CIFS/SRV1.AD.LOCAL; (4) the target's DNS resolution step, which only loosely normalizes case, treats the look-alike name as an independent, non-local destination and happily sends its AP-REQ to the attacker's relay server rather than detecting a loopback/self-authentication condition; (5) the attacker relays the valid AP-REQ to the target's real SMB (or other Kerberos-authenticated) service, completing an authentication-reflection relay that was supposed to be blocked by loopback and signing mitigations, and obtains an NT AUTHORITY\SYSTEM session.
This is tracked as CVE-2025-58726 (the Kerberos-specific reflection variant requiring either a 'ghost' SPN or write access to an SPN, patched October 2025) and, after the October 2025 SMB-signing-for-loopback mitigation closed the direct relay path, a further local-reflection pivot tracked as CVE-2026-26128 (patched March 2026 Patch Tuesday). In the local-reflection variant, the attacker builds a reverse SOCKS tunnel and a local port forwarder on the already-compromised but unprivileged target host so that the relayed AP-REQ appears to originate from 127.0.0.1, attempting to spoof the loopback-authentication detection Microsoft added after CVE-2025-33073. Microsoft's Kerberos loopback detection correlates a random subkey placed by the client into LSASS's internal relay-tracking list against the subkey presented in the AP-REQ; researchers found that removing the subkey from this list before relaying (to evade the loopback check) is not viable, because the Kerberos authenticator itself expires before the check can be raced successfully -- which is what CVE-2026-26128's hardening specifically closes.
Beyond SMB, the research notes that HTTP-based ADCS web enrollment (certsrv/certfnsh.asp) and the SCCM AdminService HTTPS endpoint remain exploitable via this coercion-and-relay pattern because neither enforces TLS channel binding, allowing an attacker to relay a coerced Kerberos ticket to request a certificate on the victim's behalf (a 'Certified Pre-Owned' style outcome) or to perform privileged SCCM administrative actions via the AdminService API. MSSQL is flagged as similarly exposed where channel binding is not enforced. The researchers explicitly state the article does not describe or claim any observed in-the-wild exploitation of the Unicode coercion technique itself, distinguishing it from CVE-2025-33073, which CISA has separately confirmed is being exploited in the wild as a Reflective Kerberos/NTLM Relay Attack.
MITRE ATT&CK techniques used in TL-2026-4866
Discovery
T1018 Remote System Discovery; T1046 Network Service Discovery
Lateral Movement
T1021.002 Remote Services: SMB/Windows Admin Shares
Command and Control
T1090 Proxy; T1572 Protocol Tunneling
Persistence
Credential Access
T1187 Forced Authentication; T1557 Adversary-in-the-Middle; T1557.001 Name Resolution Poisoning and SMB Relay; T1558 Steal or Forge Kerberos Tickets
Initial Access
T1190 Exploit Public-Facing Application
lateral-movement
T1550.003 Use Alternate Authentication Material: Pass the Ticket
defense-impairment
T1556 Modify Authentication Process
Resource Development
Affected products and versions in Windows Authentication Reflection Mitigation Bypasses for
- Microsoft — Windows SMB Client/Server (CVE-2025-33073)
Vulnerable versions: Windows 10 (all supported versions); Windows 11 pre-24H2; Windows Server 2019; Windows Server 2022; Windows Server 2025 (pre-patch)
Fixed in: June 2025 Patch Tuesday cumulative update - Microsoft — Windows SMB Server (CVE-2026-24294)
Vulnerable versions: Windows 10; Windows 11; Windows Server 2012 through Server 2025
Fixed in: March 2026 Patch Tuesday cumulative update - Microsoft — Windows SMB Server / Kerberos (CVE-2025-58726)
Vulnerable versions: Windows 10; Windows 11; Windows Server 2008 R2 through Server 2025
Fixed in: October 2025 Patch Tuesday cumulative update - Microsoft — Windows SMB Server (CVE-2026-26128)
Vulnerable versions: Windows 10; Windows 11; Windows Server 2012 through Server 2025
Fixed in: March 2026 Patch Tuesday cumulative update
Remediation for Windows Authentication Reflection Mitigation Bypasses for
Patches
- October 2025 Patch Tuesday: CVE-2025-33073 and CVE-2025-58726.
- March 2026 Patch Tuesday: CVE-2026-24294 and CVE-2026-26128.
Immediate actions
- Apply the October 2025 Patch Tuesday update that fixes CVE-2025-33073 and CVE-2025-58726.
- Apply the March 2026 Patch Tuesday update that fixes CVE-2026-24294 and CVE-2026-26128.
- Ensure SMB signing is enforced, including the loopback-signing enforcement controlled by RequireSecuritySignatureForLoopback under HKLM\System\CurrentControlSet\Services\LanmanServer\Parameters (default enabled post-patch; do not disable it).
- Disable HTTP-based ADCS web enrollment connectors (certsrv) and require HTTPS with channel binding for all ADCS enrollment endpoints.
- Restrict network reachability to the SCCM AdminService to trusted management hosts only, since it has no channel-binding option.
Workarounds
- Where patching is delayed, enforce SMB signing domain-wide via GPO and block anonymous/unauthenticated inbound SMB from workstation to workstation.
- Disable legacy HTTP ADCS enrollment entirely if HTTPS enrollment is not yet enforced.
Longer-term hardening
- Audit and restrict which accounts can write arbitrary Service Principal Names ('ghost SPN' hygiene) to limit CVE-2025-58726-style abuse.
- Enforce TLS channel binding / Extended Protection for Authentication on all Kerberos/NTLM-accepting HTTP and SQL services.
- Monitor and restrict use of authentication-coercion-capable RPC interfaces (EFSRPC/PetitPotam-style calls) from workstation subnets toward servers.
- Deploy DNS monitoring that flags registration of hostnames containing confusable Unicode characters resembling existing AD machine/service names.
- Deploy EDR/network detections for krbrelayx.py, PetitPotam, mitm6, and dnstool.py usage patterns.
CVEs associated with Windows Authentication Reflection Mitigation Bypasses for
CVE-2025-33073, CVE-2026-24294, CVE-2025-58726, CVE-2026-26128
Weaknesses (CWE) in Windows Authentication Reflection Mitigation Bypasses for
Timeline of Windows Authentication Reflection Mitigation Bypasses for
- RedTeam Pentesting researchers report the original Reflective Kerberos Relay Attack logic flaw to Microsoft, later tracked as CVE-2025-33073.
- Microsoft publishes CVE-2025-33073 (CVSS 8.8) and ships a fix in the June 2025 Patch Tuesday, modifying the SMB client driver to reject sessions carrying additional target info.
- Microsoft publishes and patches CVE-2025-58726, a Kerberos-specific authentication-reflection variant requiring a ghost SPN or SPN-write access.
- CISA adds CVE-2025-33073 to the Known Exploited Vulnerabilities catalog, confirming in-the-wild exploitation and setting a remediation due date of 2025-11-10.
- Microsoft's March 2026 Patch Tuesday fixes CVE-2026-24294 (SMB connection-multiplexing LPE) and CVE-2026-26128 (hardened Kerberos loopback detection against subkey-removal race).
- Synacktiv publishes Part 1 of 'Bypassing Windows authentication reflection mitigations for SYSTEM shells,' detailing the SMB connection-multiplexing bypass of the original CVE-2025-33073 fix (CVE-2026-24294).
- Synacktiv publishes Part 2, introducing the Unicode look-alike DNS coercion technique for Kerberos service-ticket reflection, covering CVE-2025-58726 and CVE-2026-26128 and noting continued exposure of HTTP ADCS enrollment, SCCM AdminService, and MSSQL where channel binding is not enforced.
Sources cited for Windows Authentication Reflection Mitigation Bypasses for
- Bypassing Windows authentication reflection mitigations for SYSTEM shells - Part 2 (Guillaume Andre, Synacktiv)
- Bypassing Windows authentication reflection mitigations for SYSTEM shells - Part 1 (Guillaume Andre, Synacktiv)
- CVE-2025-33073 - Microsoft Security Response Center
- CVE-2026-24294 - Microsoft Security Response Center
- CVE-2025-58726 - Microsoft Security Response Center
- CVE-2026-26128 - Microsoft Security Response Center
- CISA Known Exploited Vulnerabilities Catalog entry for CVE-2025-33073
- CISA warns of Windows SMB flaw under active exploitation (CVE-2025-33073)
- Just-in-Time Bulletin: CVE-2025-33073 Reflective Kerberos Relay Attack
- Windows network vulnerability CVE-2025-33073 (Reflective Kerberos Relay Attack)
- CVE-2025-33073 NTLM Reflection Attack executive summary
- 0xNDI/CVE-2026-24294 proof-of-concept repository
Detection coverage for TL-2026-4866
As of 2026-10-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4866 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.