---
id: 6339
title: "CVE-2026-24294: Windows SMB local NTLM reflection privilege-escalation PoC"
cve: CVE-2026-24294
cvss: 7.8
severity: high
vendor: "Microsoft"
product: "Windows SMB Server"
affected_versions: "Multiple supported Windows 10, Windows 11, and Windows Server releases; this PoC specifically targets Windows Server 2025 default configuration"
source_domain: github.com
source_url: "https://github.com/0xNDI/CVE-2026-24294"
published_at: "2026-04-30T04:31:14Z"
tags: ["public-poc", "featured", "privilege-escalation", "windows", "windows-server", "smb", "ntlm", "ntlm-reflection", "lpe", "poc", "petitpotam", "cve-2026-24294"]
phying_url: "https://phying.com/item/6339"
lang: en
---

# CVE-2026-24294: Windows SMB local NTLM reflection privilege-escalation PoC

## Summary

This public PoC targets the default Windows Server 2025 configuration. It combines SMB connections on an arbitrary port with session multiplexing to reflect coerced privileged NTLM authentication back to the local SMB service, allowing a local low-privilege user to obtain NT AUTHORITY\SYSTEM. Microsoft classifies the underlying issue as improper authentication in Windows SMB Server leading to local privilege escalation, with multiple Windows 10, Windows 11, and Windows Server releases affected.

## Why it matters

The official CVSS 3.1 vector requires local low-privilege access, but attack complexity is low, no user interaction is required, and successful exploitation can fully impact confidentiality, integrity, and availability. Apply the latest Microsoft security update for each Windows release; also enforce SMB signing, restrict NTLM, and monitor for unusual local SMB relay activity. Public information currently confirms a PoC, not active exploitation in the wild.

## Intelligence Metadata

- **Sources:** github.com
- **CVE:** CVE-2026-24294
- **CVSS:** 7.8
- **Vendor:** Microsoft
- **Product:** Windows SMB Server
- **Affected versions:** Multiple supported Windows 10, Windows 11, and Windows Server releases; this PoC specifically targets Windows Server 2025 default configuration
- **Published:** 2026-04-30T04:31:14Z
- **Original:** https://github.com/0xNDI/CVE-2026-24294
- **Phying News:** https://phying.com/item/6339