CVE-2026-24294: Windows SMB local NTLM reflection privilege-escalation PoC

This public PoC targets the default Windows Server 2025 configuration. It combines SMB connections on an arbitrary port with session multiplexing to reflect coerced privileged NTLM authentication back to the local SMB service, allowing a local low-privilege user to obtain NT AUTHORITY\SYSTEM. Microsoft classifies the underlying issue as improper authentication in Windows SMB Server leading to local privilege escalation, with multiple Windows 10, Windows 11, and Windows Server releases affected.

The official CVSS 3.1 vector requires local low-privilege access, but attack complexity is low, no user interaction is required, and successful exploitation can fully impact confidentiality, integrity, and availability. Apply the latest Microsoft security update for each Windows release; also enforce SMB signing, restrict NTLM, and monitor for unusual local SMB relay activity. Public information currently confirms a PoC, not active exploitation in the wild.