# Windows Authentication Reflection Mitigation Bypasses for SYSTEM Shells via Kerberos Unicode Coercion (CVE-2025-33073, CVE-2026-24294, CVE-2025-58726, CVE-2026-26128)

> Synacktiv research (Part 2, published 2026-04-30) documents a Kerberos coercion technique that registers DNS records using look-alike Unicode characters so that the DNS client treats the name as distinct from the local host while the domain controller still issues a valid Kerberos service ticket for the real machine account. The technique chains with coercion tools to achieve authenticated RCE as a domain user and local privilege escalation to SYSTEM, building on an insufficient initial fix for CVE-2025-33073 (listed in the CISA KEV catalog as exploited in the wild).

- **Published:** 2026-10-31T00:10:06Z
- **Last reviewed:** 2026-10-31T00:38:18.869Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4866
- **ID:** TL-2026-4866
- **Severity:** HIGH (CVSS 8.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 19 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-33073, CVE-2026-24294, CVE-2025-58726, CVE-2026-26128

## Description

Windows has layered several defenses against authentication reflection, where a host's own coerced authentication is relayed back to itself to obtain SYSTEM privileges. Synacktiv researcher Guillaume Andre published two related analyses in 2026 showing these defenses can still be bypassed, and that Microsoft's original patch for CVE-2025-33073 treated a symptom rather than the underlying design issue.

Part 1 (published 2026-04-27) covers CVE-2025-33073 and the follow-on CVE-2026-24294. The original CVE-2025-33073 fix modified the Windows SMB client driver (mrxsmb.sys) to reject SMB sessions carrying additional target information used in relay attacks. Part 1 shows this can be bypassed by abusing SMB connection multiplexing, a feature introduced with Windows 11 24H2 and Windows Server 2025: the WNetAddConnection4W API accepts a custom TCP port through an undocumented buffer. An attacker stands up a local SMB listener on a non-default port, coerces a privileged local service into authenticating to that listener, and relays the resulting credential material to the genuine SMB service for local privilege escalation to SYSTEM. Windows Server 2025 is described as vulnerable by default; Windows 11 24H2 is not, because it enforces SMB signing more broadly. CVE-2026-24294 was addressed in the March 2026 Patch Tuesday.

Part 2 (published 2026-04-30) generalizes the bypass to Kerberos and introduces the Unicode-substitution DNS coercion technique that is the primary subject of this record. Windows components normalize Unicode strings inconsistently: LDAP name resolution inside Active Directory (via LCMapStringEx with flags including NORM_IGNOREWIDTH and NORM_IGNORECASE) folds visually similar characters -- for example the circled Latin capital letter R (U+24C7) in place of ASCII 'R', or the Unicode one-dot leader (U+2024) in place of a period -- into the same sort key as the canonical ASCII hostname. The Windows DNS client cache service, however, compares strings with CompareStringW using only NORM_IGNORECASE, so a name such as SRV1 with the R replaced by U+24C7 and dots replaced by U+2024 compares as NOT equal to the real 'SRV1.AD.LOCAL' and triggers an independent DNS lookup.

An attacker abuses this gap by: (1) registering a DNS record for the Unicode look-alike name pointing at an attacker-controlled relay host, using an LDAP-based DNS registration tool (dnstool.py); (2) coercing a target machine (via PetitPotam or a similar coercion primitive) to authenticate to the Unicode look-alike name instead of its own real FQDN; (3) when the target's Kerberos client builds a TGS-REQ for a service principal name built from the look-alike string, the domain controller's LDAP-based account lookup folds the Unicode variant back onto the real 'SRV1$' machine account and issues a legitimate Kerberos service ticket for CIFS/SRV1.AD.LOCAL; (4) the target's DNS resolution step, which only loosely normalizes case, treats the look-alike name as an independent, non-local destination and happily sends its AP-REQ to the attacker's relay server rather than detecting a loopback/self-authentication condition; (5) the attacker relays the valid AP-REQ to the target's real SMB (or other Kerberos-authenticated) service, completing an authentication-reflection relay that was supposed to be blocked by loopback and signing mitigations, and obtains an NT AUTHORITY\SYSTEM session.

This is tracked as CVE-2025-58726 (the Kerberos-specific reflection variant requiring either a 'ghost' SPN or write access to an SPN, patched October 2025) and, after the October 2025 SMB-signing-for-loopback mitigation closed the direct relay path, a further local-reflection pivot tracked as CVE-2026-26128 (patched March 2026 Patch Tuesday). In the local-reflection variant, the attacker builds a reverse SOCKS tunnel and a local port forwarder on the already-compromised but unprivileged target host so that the relayed AP-REQ appears to originate from 127.0.0.1, attempting to spoof the loopback-authentication detection Microsoft added after CVE-2025-33073. Microsoft's Kerberos loopback detection correlates a random subkey placed by the client into LSASS's internal relay-tracking list against the subkey presented in the AP-REQ; researchers found that removing the subkey from this list before relaying (to evade the loopback check) is not viable, because the Kerberos authenticator itself expires before the check can be raced successfully -- which is what CVE-2026-26128's hardening specifically closes.

Beyond SMB, the research notes that HTTP-based ADCS web enrollment (certsrv/certfnsh.asp) and the SCCM AdminService HTTPS endpoint remain exploitable via this coercion-and-relay pattern because neither enforces TLS channel binding, allowing an attacker to relay a coerced Kerberos ticket to request a certificate on the victim's behalf (a 'Certified Pre-Owned' style outcome) or to perform privileged SCCM administrative actions via the AdminService API. MSSQL is flagged as similarly exposed where channel binding is not enforced. The researchers explicitly state the article does not describe or claim any observed in-the-wild exploitation of the Unicode coercion technique itself, distinguishing it from CVE-2025-33073, which CISA has separately confirmed is being exploited in the wild as a Reflective Kerberos/NTLM Relay Attack.

## MITRE ATT&CK

- T1187 Forced Authentication
- T1557.001 Name Resolution Poisoning and SMB Relay
- T1557 Adversary-in-the-Middle
- T1558 Steal or Forge Kerberos Tickets
- T1550.003 Use Alternate Authentication Material: Pass the Ticket
- T1021.002 Remote Services: SMB/Windows Admin Shares
- T1556 Modify Authentication Process
- T1190 Exploit Public-Facing Application
- T1584.002 DNS Server
- T1018 Remote System Discovery
- T1046 Network Service Discovery
- T1090 Proxy
- T1572 Protocol Tunneling
- T1098 Account Manipulation
- T1068 Exploitation for Privilege Escalation
- T1571 Non-Standard Port

## Sources

- [Bypassing Windows authentication reflection mitigations for SYSTEM shells - Part 2 (Guillaume Andre, Synacktiv)](https://www.synacktiv.com/en/publications/bypassing-windows-authentication-reflection-mitigations-for-system-shells-part.html)
- [Bypassing Windows authentication reflection mitigations for SYSTEM shells - Part 1 (Guillaume Andre, Synacktiv)](https://www.synacktiv.com/en/publications/bypassing-windows-authentication-reflection-mitigations-for-system-shells-part-1.html)
- [CVE-2025-33073 - Microsoft Security Response Center](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-33073)
- [CVE-2026-24294 - Microsoft Security Response Center](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24294)
- [CVE-2025-58726 - Microsoft Security Response Center](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-58726)
- [CVE-2026-26128 - Microsoft Security Response Center](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26128)
- [CISA Known Exploited Vulnerabilities Catalog entry for CVE-2025-33073](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [CISA warns of Windows SMB flaw under active exploitation (CVE-2025-33073)](https://www.helpnetsecurity.com/?p=345823)
- [Just-in-Time Bulletin: CVE-2025-33073 Reflective Kerberos Relay Attack](https://www.nopsec.com/resources/just-in-time/just-in-time-bulletin-cve-2025-33073-reflective-kerberos-relay-attack/)
- [Windows network vulnerability CVE-2025-33073 (Reflective Kerberos Relay Attack)](https://borncity.com/win/2025/06/11/windows-network-vulnerability-cve-2025-33073-reflective-kerberos-relay-attack/)
- [CVE-2025-33073 NTLM Reflection Attack executive summary](https://aviatrix.ai/threat-research-center/cve-2025-33073-ntlm-reflection-attack)
- [0xNDI/CVE-2026-24294 proof-of-concept repository](https://github.com/0xNDI/CVE-2026-24294)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4866