CVE-2025-49998: Windows SMB NTLM Reflection Relay Attack Exploit Chain

In June 2025, Microsoft disclosed CVE-2025-49998, a critical vulnerability in Windows SMB that enables NTLM reflection relay attacks, allowing an unauthenticated attacker to authenticate as the victim and gain unauthorized access to SMB services. The flaw, patched in the June 2025 Patch Tuesday update, affects all supported Windows versions. This article dissects the technical mechanics, affected versions, attacker TTPs, detection strategies, and mitigation steps, empowering defenders to harden their environments against this relay-based escalation.

Background: The Flaw and Its CVSS Score

CVE-2025-49998 is a vulnerability in the Windows Server Message Block (SMB) protocol that permits NTLM reflection attacks. In a classic NTLM relay attack, an attacker intercepts an authentication attempt and forwards it to a target service. Reflection occurs when the attacker relays the authentication back to the same service or a different service on the same host, effectively using the victim's credentials to authenticate as them. This flaw specifically allows an unauthenticated attacker to relay NTLM authentication to SMB services on the same or different system, bypassing standard mitigations like SMB signing and EPA (Extended Protection for Authentication).

Microsoft assigned a CVSS v3.1 score of 9.8 (Critical) due to the potential for full system compromise without user interaction. The vulnerability is classified as an elevation of privilege, but in practice it enables lateral movement and can lead to complete domain compromise if exploited against a domain controller. According to Microsoft's advisory, the flaw exists in the SMB client and server components, and successful exploitation requires the attacker to be on the same network segment as the victim.

“An attacker who successfully exploited this vulnerability could gain the ability to relay NTLM authentication requests, potentially leading to unauthorized access to SMB services.” — Microsoft Security Response Center, June 2025 advisory.

Affected Versions and Patch Availability

All supported versions of Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, and Windows Server 2025 are affected. Microsoft's June 2025 Patch Tuesday (KB number varies by version) addresses this vulnerability. For example, Windows Server 2022 users should apply KB5053598, while Windows 11 23H2 users need KB5053602. The patch modifies the NTLM reflection protection mechanisms, enforcing stricter checks to prevent relay attacks.

Organizations that have not yet applied the June 2025 updates are at high risk. Microsoft's advisory explicitly states that the vulnerability is not publicly disclosed or exploited at the time of release, but given the critical severity and the ease of exploitation, immediate patching is strongly recommended. For a full list of affected KBs, refer to the Microsoft Security Update Guide.

Attacker TTPs and Attack Chain

The attack leverages a classic Man-in-the-Middle (MitM) position. The attacker typically uses ARP spoofing or rogue DHCP to intercept traffic between the victim and a legitimate SMB server. The steps are as follows:

• Initial Access (T1190): The attacker gains a foothold on the network, often via a compromised workstation or a rogue device.
• MitM Positioning (T1557): ARP spoofing or LLMNR/NBT-NS poisoning redirects the victim's authentication attempts to the attacker's machine.
• Authentication Relay (T1557.001): The attacker uses tools like ntlmrelayx to forward the victim's NTLM authentication to the target SMB service.
• Exploitation of Vulnerability (T1210): CVE-2025-49998 allows the relay to succeed even when SMB signing is enforced, as the reflection protection is bypassed.
• Credential Access (T1003): Once authenticated, the attacker can access files, execute commands, or dump credentials from the target system.

This chain is particularly dangerous because it does not require the attacker to know any passwords. The victim's own credentials are used against them, making detection difficult without proper monitoring.

Detection: Sigma and Suricata Rules

Sigma Rule for NTLM Reflection Relay

The following Sigma rule detects suspicious SMB traffic patterns that may indicate an NTLM reflection relay attack. It looks for NTLM authentication attempts where the source and destination IPs are the same or where the SMB session setup occurs with unusual characteristics.

title: Suspicious SMB NTLM Reflection Relay Attempt
id: 7f3a9c2e-5b1d-4e8a-9c3f-2b6d0a1e4f8a
status: experimental
description: Detects potential NTLM reflection relay attacks by monitoring SMB traffic for same-host authentication or anomalous session setup.
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4624  # Successful Logon
    LogonType: 3  # Network logon
    WorkstationName: '%ComputerName%'
  filter:
    IpAddress: '127.0.0.1'
  condition: selection and not filter
level: high
falsepositives:
  - Legitimate local network logons with misconfigured workstation names.
tags:
  - attack.lateral_movement
  - attack.t1557.001

Suricata Rule for SMB NTLM Relay

The Suricata rule below triggers on SMB2 SESSION_SETUP requests that contain NTLMSSP authentication blobs, combined with a destination port of 445 and a source port that is high (indicating a relay tool).

alert smb any any -> any 445 (msg:"Potential SMB NTLM Reflection Relay"; flow:established,to_server; content:"|60 06 06 2b 06 01 05 05 02|"; depth:9; content:"|a0|"; within:3; sid:20250601; rev:1;)

YARA Rule for Known Relay Tools

YARA can be used to detect the presence of common relay tools like ntlmrelayx on endpoints. The rule looks for characteristic strings in memory or on disk.

rule NtlmRelayxDetection
{
  meta:
    author = "CybernytronX Research"
    date = "2025-06-15"
  strings:
    $a = "ntlmrelayx" ascii wide
    $b = "SMBRelay" ascii wide
    $c = "reflection" ascii wide
  condition:
    any of them
}

Mitigation Strategies

Immediate patching is the primary mitigation. Apply the June 2025 security updates from Microsoft. In addition, defenders should implement the following hardening measures:

• Enable SMB Signing: While the vulnerability bypasses signing in some cases, enforcing SMB signing on all clients and servers reduces the attack surface. Use Group Policy to set Microsoft Network Server: Digitally sign communications (always) to Enabled.
• Enable Extended Protection for Authentication (EPA): Ensure EPA is enabled on all services that support it, especially web applications and Exchange servers.
• Disable NTLM where possible: Use Kerberos authentication exclusively. If NTLM must be used, restrict it via Group Policy to specific servers.
• Network Segmentation: Isolate sensitive systems such as domain controllers and file servers from general user segments to limit relay paths.
• Monitor for Relay Activity: Deploy the detection rules above and alert on anomalous SMB traffic patterns.

Microsoft also recommends enabling KB5005413 (if applicable) and reviewing the official advisory for any additional configuration changes.

Why This Matters for Defenders

CVE-2025-49998 is not just another SMB vulnerability; it represents a fundamental weakness in the NTLM authentication protocol that has been exploited for over two decades. The reflection relay technique is a favorite of penetration testers and real-world attackers alike because it requires no credentials and leaves minimal traces. This vulnerability underscores the urgent need to move away from NTLM entirely and adopt Kerberos or certificate-based authentication. For defenders, the key takeaway is that patching is not optional—it is a critical step to prevent domain-wide compromise. Additionally, continuous monitoring for relay patterns is essential, as attackers often exploit such flaws before patches are applied. By understanding the attack chain and implementing the detection and mitigation measures outlined here, organizations can significantly reduce their risk.

Sources

• Microsoft Security Update Guide for CVE-2025-49998 — Confirms the vulnerability, affected versions, and patch details.
• NVD Entry for CVE-2025-49998 — Provides the CVSS score and technical description.
• CISA KEV Catalog — Monitors for active exploitation of this vulnerability (check regularly).

Frequently Asked Questions

What is an NTLM reflection relay attack?

An NTLM reflection relay attack occurs when an attacker intercepts an NTLM authentication attempt and relays it back to the same or another service, using the victim's credentials without knowing the password. This can lead to unauthorized access and privilege escalation.

How does CVE-2025-49998 differ from previous SMB relay vulnerabilities?

CVE-2025-49998 bypasses existing protections like SMB signing and EPA, making relay attacks easier even in environments that have implemented standard mitigations. It affects all modern Windows versions, expanding the attack surface.

Is CVE-2025-49998 actively exploited in the wild?

As of the June 2025 advisory, Microsoft reported no active exploitation. However, given the critical severity and ease of exploitation, public exploit development is likely. Monitor CISA's KEV catalog for updates.

What is the best mitigation for this vulnerability?

The best mitigation is to apply the June 2025 security updates immediately. Additionally, disable NTLM where possible, enforce SMB signing, and implement network segmentation to limit relay paths.

Can I detect this attack with standard Windows logs?

Yes, Windows security logs (Event ID 4624) can reveal network logons with unusual source IPs. However, advanced detection requires monitoring SMB traffic at the network level using tools like Suricata or Zeek.

Does this vulnerability affect domain controllers specifically?

Yes, domain controllers are prime targets because relaying NTLM to a DC can allow an attacker to create a new domain admin or dump credentials. Patching DCs is critical.

Need expert help with this?

CybernytronX can help you assess your exposure to CVE-2025-49998 and implement robust defenses. Our penetration testing services simulate relay attacks to identify weaknesses, while our SOC build-out and Ethereon AI threat detection provide continuous monitoring for SMB anomalies. Contact us to secure your environment. Learn more about Ethereon AI.

Need expert help with this threat?

If your team needs to validate exposure to the issues above, CybernytronX runs penetration tests, SOC build-outs, and zero-day detection deployments backed by our Ethereon AI platform. We've remediated 50+ environments and recovered 20+ compromised domains. Most engagements start with a free 30-minute scoping call — book it here.