CVE-2025-49984: Windows SMB client NTLM relay zero-day PoC analysis

On March 2025, a critical zero-day vulnerability in the Windows SMB client was disclosed as CVE-2025-49984, allowing an unauthenticated attacker to relay NTLM authentication credentials via a malicious SMB server. The flaw, which resides in the SMB client's handling of NTLM authentication, was publicly demonstrated with a proof-of-concept exploit shortly after disclosure. This article dissects the technical details of the vulnerability, its attack chain, and provides actionable detection and mitigation strategies for defenders.

Background: The SMB Client NTLM Relay Flaw

CVE-2025-49984 is a vulnerability in the Windows SMB client that permits NTLM relay attacks, a technique where an attacker intercepts authentication requests and forwards them to a target service to impersonate the user. Unlike traditional NTLM relay attacks that target SMB servers, this flaw specifically affects the client side, making it possible for a malicious server to coerce the client into authenticating to an attacker-controlled endpoint. The vulnerability was disclosed in March 2025, and a proof-of-concept (PoC) was published shortly afterward, demonstrating the attack in a controlled environment.

According to the Microsoft Security Response Center (MSRC) advisory, the vulnerability has a CVSS score of 8.1 (High), reflecting the potential for credential theft and lateral movement in enterprise environments. The flaw stems from improper validation of NTLM authentication responses in the SMB client, allowing an attacker to manipulate the authentication flow to relay credentials to a different service, such as LDAP or HTTP, if those services are configured to accept NTLM.

\"An attacker who successfully exploited this vulnerability could relay NTLM authentication credentials to another service, potentially gaining unauthorized access to sensitive resources.\" — Microsoft Security Response Center

Affected Versions and Patch Information

Microsoft's advisory for CVE-2025-49984 lists all supported versions of Windows 10, Windows 11, and Windows Server 2016 through 2022 as affected. The vulnerability was addressed in the March 2025 Patch Tuesday update, which included a security update that corrects the SMB client's NTLM authentication validation. Organizations are strongly advised to apply the update immediately, as the PoC has been publicly released, increasing the risk of exploitation.

For a complete list of affected versions and the specific update KB numbers, refer to the official MSRC advisory. Additionally, the NVD entry provides technical details and references.

Attack Chain and Attacker TTPs

The attack chain for CVE-2025-49984 involves several steps, each mapping to specific MITRE ATT&CK techniques:

• Initial Access (T1190): The attacker sets up a malicious SMB server, often on the same network segment as the target or via a phishing link that redirects the victim to the server.
• Exploitation (T1203): The victim's SMB client connects to the malicious server, triggering the vulnerable NTLM authentication handshake.
• Credential Relay (T1557): The attacker captures the NTLM authentication and relays it to a target service, such as LDAP or HTTP, to impersonate the user.
• Lateral Movement (T1021): Using the relayed credentials, the attacker can access other systems or services, potentially escalating privileges.

This attack does not require the attacker to crack the NTLM hash; instead, it leverages the authentication flow itself, making it particularly dangerous in environments where NTLM is still enabled.

Detection Opportunities

Detecting exploitation of CVE-2025-49984 requires monitoring for suspicious SMB client activity and NTLM authentication anomalies. The following Sigma rule can help identify potential NTLM relay attempts originating from a client:

title: Suspicious SMB Client NTLM Authentication to Non-Standard Ports
status: experimental
description: Detects SMB client connections to unusual ports, potentially indicating NTLM relay to other services.
logsource:
  product: windows
  category: network_connection
detection:
  selection:
    DestinationPort:
      - 445
      - 139
      - 88
      - 389
      - 636
    Initiated: 'true'
  filter:
    DestinationIp:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection and not filter
level: high

Additionally, enable logging of NTLM authentication events (Event ID 8004) and monitor for multiple authentication attempts to different services within a short time frame, which may indicate relay activity.

Mitigation Strategies

Effective mitigation involves a multi-layered approach:

• Apply the March 2025 security update to all affected Windows systems, as detailed in the MSRC advisory.
• Disable NTLM authentication where possible, using Group Policy to restrict NTLM usage to only necessary services. Microsoft provides guidance in this document.
• Enforce SMB signing to prevent man-in-the-middle attacks, as unsigned SMB traffic is more susceptible to relay.
• Implement network segmentation to limit the impact of a successful relay, isolating critical services from general client traffic.
• Use Extended Protection for Authentication (EPA) on services that accept NTLM, such as Exchange and web applications, to bind the authentication to the TLS channel.

Why This Matters for Defenders

CVE-2025-49984 represents a significant shift in NTLM relay exploitation, targeting the client rather than the server. This makes it more challenging to detect using traditional server-side monitoring and expands the attack surface to any Windows machine that connects to SMB shares. The public availability of a PoC lowers the skill barrier for attackers, increasing the likelihood of exploitation in the wild. Defenders must prioritize patching, but also revisit their NTLM usage policies and monitoring capabilities to detect relay attempts. Organizations that have not yet migrated away from NTLM should accelerate efforts to adopt Kerberos or other modern authentication mechanisms, as this vulnerability highlights the inherent risks of NTLM in modern networks.

Sources

• Microsoft Security Response Center Advisory for CVE-2025-49984 — Confirms vulnerability details, affected versions, and patch information.
• NVD Entry for CVE-2025-49984 — Provides CVSS score and technical summary.
• Microsoft Documentation on Restricting NTLM Traffic — Official guidance for mitigating NTLM relay risks.

Frequently Asked Questions

What is CVE-2025-49984?

CVE-2025-49984 is a vulnerability in the Windows SMB client that allows an attacker to relay NTLM authentication credentials to another service, potentially gaining unauthorized access. It was disclosed in March 2025 and has a CVSS score of 8.1.

How can I detect exploitation of CVE-2025-49984?

Monitor for unusual SMB client connections to non-standard ports, enable NTLM authentication logging (Event ID 8004), and look for multiple authentication attempts to different services within a short time window. The Sigma rule provided in this article can be adapted for your SIEM.

Is there a patch available for CVE-2025-49984?

Yes, Microsoft released a security update in the March 2025 Patch Tuesday. Apply all relevant updates to affected Windows versions as soon as possible.

Does disabling NTLM completely mitigate this vulnerability?

Disabling NTLM entirely would prevent the relay, but many environments still rely on NTLM for legacy compatibility. Use Group Policy to restrict NTLM to only necessary services, and consider migrating to Kerberos where feasible.

What is the difference between this and traditional NTLM relay attacks?

Traditional NTLM relay attacks target SMB servers, while this vulnerability affects the client, making it possible for a malicious server to coerce the client into relaying credentials. This expands the attack surface and complicates detection.

Can this vulnerability be exploited remotely?

Yes, if an attacker can trick a user into connecting to a malicious SMB server, they can exploit the vulnerability. This can be done via phishing links or by compromising a legitimate share.

Need expert help with this?

CybernytronX can help you assess your exposure to CVE-2025-49984 and strengthen your NTLM security posture. Our penetration testing services identify vulnerabilities like this before attackers do, and our SOC build-out and Ethereon AI threat detection can monitor for suspicious authentication activity. Contact us to learn more, or explore Ethereon for advanced threat detection.

Need expert help with this threat?

If your team needs to validate exposure to the issues above, CybernytronX runs penetration tests, SOC build-outs, and zero-day detection deployments backed by our Ethereon AI platform. We've remediated 50+ environments and recovered 20+ compromised domains. Most engagements start with a free 30-minute scoping call — book it here.