Windows SMB Server Elevation of Privilege Vulnerability

An authorized user with valid SMB credentials could escalate their privileges on Windows servers and workstations, potentially gaining administrative access and the ability to alter system configurations or access sensitive data across your network.

All organizations running Windows Server 2022, 2025, Windows 10 (all recent versions), or Windows 11 (all recent versions) are affected. This impacts domain-joined workstations and servers used for file sharing, print services, or remote administration. OT environments using Windows-based HMI systems, engineering workstations, or data historian servers are at risk if they allow SMB access from user networks or have mixed IT/OT connectivity.

An attacker with valid domain or local credentials connects to the SMB service (port 445) on a Windows system. The attacker sends a specially crafted authentication request that exploits a flaw in the authentication algorithm, allowing them to bypass privilege checks and gain elevated access without requiring admin credentials.