PoC Released for NTLM reflection bypass Vulnerability that Emanbles SYSTEM Access on Windows Server

Gbhackers •Mayura Kathir • June 30, 2026

A proof-of-concept has been published that bypasses Microsoft’s mitigation for the NTLM reflection vulnerability tracked as CVE-2025-33073 and allows escalation to NT AUTHORITY\SYSTEM on Windows Server. The exploit leverages two conceptual weaknesses left unaddressed by the original patch: the mitigation was limited to the SMB client path, and recent SMB features let attackers coerce privileged […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

New PoC Exploit for NTLM Reflection Bypass Vulnerability on Windows Server A proof-of-concept (PoC) exploit has been released for a NTLM reflection bypass vulnerability, tracked as CVE-2026-24294, which allows attackers to gain SYSTEM-level access on Windows Server 2025. This vulnerability arises from design flaws that were not fully addressed by the previous patch for CVE-2025-33073. The original mitigation only covered the SMB client path, leaving other vectors open for exploitation. The PoC was made public on April 30, 2026, and raises significant concerns about the effectiveness of Microsoft's authentication hardening measures. Organizations using Windows Server 2025 are at risk, particularly those that have not implemented additional security layers. The release of the PoC has prompted urgent advisories for system administrators to assess their environments and apply necessary mitigations. 3 sources 72

Extracted Entities

PoC Released for NTLM reflection bypass Vulnerability that Emanbles SYSTEM Access on Windows Server

The full story

Extracted Entities

CVEs (1)

MITRE ATT&CK (2)

Platforms (1)

Vulnerabilities (1)