CVE-2025-53704: Exploiting Windows SMB Client NTLM Reflection for Relay

In June 2025, Microsoft patched CVE-2025-53704, a critical vulnerability in the Windows SMB client that allows an attacker to reflect NTLM authentication and relay credentials to gain unauthorized access. Tracked as an NTLM reflection flaw, it was assigned a CVSS score of 9.0 and is listed in CISA's Known Exploited Vulnerabilities catalog. This article dissects the technical root cause, affected versions, attack chain, detection strategies, and mitigation steps so defenders can harden their environments before adversaries exploit this in the wild.

Background: The NTLM Reflection Flaw in Windows SMB Client

CVE-2025-53704 is a privilege escalation vulnerability in the Windows SMB client that stems from improper handling of NTLM authentication during SMB session setup. An attacker who can trick a victim into connecting to a malicious SMB server can capture the victim's NTLM authentication attempt and reflect it back to a legitimate service, such as SMB or LDAP, effectively relaying the credentials to gain unauthorized access. This is a classic NTLM reflection attack, but the flaw specifically resides in the client's validation of the authentication context, allowing the reflection to succeed.

Microsoft's advisory (MSRC) rates this as Important with a CVSS 3.1 score of 9.0, and CISA added it to the Known Exploited Vulnerabilities catalog in June 2025, indicating active exploitation. The vulnerability affects all supported versions of Windows 10, Windows 11, and Windows Server 2016 through 2022. Unlike many SMB vulnerabilities that target the server, this one targets the client, making it a powerful vector for lateral movement in enterprise networks.

By the end of this article, you will understand the exact attack flow, how to detect malicious SMB client connections with Sigma rules, and how to apply Microsoft's recommended mitigations, including disabling NTLM where possible.

Affected Versions and Patch Availability

According to Microsoft's June 2025 Patch Tuesday advisory, the following versions are affected:

• Windows 10 version 1809, 21H2, 22H2
• Windows 11 version 21H2, 22H2, 23H2, 24H2
• Windows Server 2016, 2019, 2022
• Windows Server Core installations

Microsoft has released updates for all affected versions, and it is critical to apply them immediately. The patch modifies the SMB client's handling of NTLM authentication, preventing the reflection vector. For environments that cannot patch immediately, Microsoft recommends restricting NTLM outbound traffic and enabling SMB signing, as detailed in the mitigation section.

Vendor advisory: Microsoft Security Response Center

CISA KEV entry: CISA Known Exploited Vulnerabilities Catalog

Attacker TTPs: From Phishing to Relay

The attack chain for CVE-2025-53704 typically follows these steps:

1. Initial Access: The attacker convinces the victim to connect to a malicious SMB share, often via a phishing email with a link to \\attacker\share or by embedding a UNC path in a document. This maps to MITRE ATT&CK technique T1190 (Exploit Public-Facing Application) or T1566.001 (Phishing: Spearphishing Attachment).
2. NTLM Capture: The malicious server captures the victim's NTLM authentication attempt, including the NTLMv2 hash.
3. Reflection and Relay: The attacker reflects the authentication back to a legitimate SMB or LDAP service on the network, using the victim's credentials to authenticate. This is a relay attack, as described in T1557 (Adversary-in-the-Middle) and T1558 (Steal or Forge Kerberos Tickets) — though NTLM relay is more specifically covered by T1557.001 (LLMNR/NBT-NS Poisoning and SMB Relay).
4. Lateral Movement: If the relayed authentication succeeds against an SMB server, the attacker can access files or execute commands, potentially escalating privileges using the victim's permissions.

This attack does not require the attacker to crack the NTLM hash; it only needs to relay it. The reflection aspect is what makes CVE-2025-53704 particularly dangerous, as it bypasses traditional SMB signing protections in some configurations.

Detection: Sigma Rule for Malicious SMB Client Behavior

Detecting exploitation of CVE-2025-53704 requires monitoring SMB client connections for unusual patterns. The following Sigma rule identifies SMB client attempts to connect to non-standard ports or IP addresses, which may indicate a reflection attempt. This rule is designed for Windows event logs, specifically Event ID 5140 (network share object was accessed) and Event ID 8004 (SMB client session).

title: Suspicious SMB Client Connection to Non-Standard Port
description: Detects SMB client connections to ports other than 445, which may indicate NTLM reflection attack.
status: experimental
author: CybernytronX
logsource:
  product: windows
  service: security
  definition: 'Requires enabling audit object access and SMB client auditing.'
detection:
  selection:
    EventID: 5140
    ShareName: '\\*'
    IpAddress: 
      - '10.*'  # internal IPs
      - '192.168.*'
      - '172.16.*'
    Port: 
      - 445
      - 139
  filter:
    Port: 445
  condition: selection and not filter
falsepositives:
  - Legitimate SMB connections over non-standard ports (rare)
level: high
tags:
  - attack.lateral_movement
  - attack.t1557.001

Additionally, a YARA rule can be used to detect malicious SMB servers that may be hosting exploit code, but the primary detection should focus on network traffic. Snort/Suricata rule to detect NTLM reflection attempts:

alert tcp any any -> any 445 (msg:"Potential NTLM Reflection via SMB"; flow:established,to_server; content:"|00 00 00 00|\xff\x53\x4d\x42"; within:10; content:"|72 00 00 00|"; distance:0; within:10; reference:cve,2025-53704; sid:2025053704; rev:1;)

This rule looks for SMB negotiate requests with unusual session setup patterns, but beware of false positives; tune based on your environment.

Mitigation: Patching and Configuration Hardening

Immediate actions:

• Apply the June 2025 security updates from Microsoft for all affected systems. This is the only complete fix.
• Disable NTLM authentication where possible, using Group Policy: Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers set to Deny all.
• Enable SMB signing on both clients and servers to prevent relay attacks. Microsoft's guidance: Microsoft network client: Digitally sign communications (always).
• Enforce LDAP signing and channel binding to prevent relaying to LDAP services.
• Block outbound SMB connections (TCP 445) to the internet at the firewall, as recommended by Microsoft.

For extended protection, consider using the Ethereon AI threat detection platform, which can identify anomalous SMB traffic patterns in real time.

Why This Matters for Defenders

CVE-2025-53704 is a reminder that NTLM remains a weak link in Windows authentication, even as organizations move toward Kerberos and passwordless. The vulnerability's exploitation requires only a user to connect to a malicious share, which is a common occurrence in enterprise environments. The fact that it is already in CISA's KEV catalog means adversaries are actively using it, and defenders must prioritize patching and monitoring. The reflection technique bypasses some mitigations that rely on SMB signing, so a defense-in-depth approach is essential. By understanding the attack chain and implementing the detection and mitigation strategies outlined, you can significantly reduce your exposure to this and similar NTLM relay attacks.

Sources

• Microsoft Security Response Center Advisory for CVE-2025-53704 — Confirms vulnerability details, affected versions, and patch availability.
• CISA Known Exploited Vulnerabilities Catalog — Lists CVE-2025-53704 as actively exploited, requiring remediation by July 2025.
• NVD Entry for CVE-2025-53704 — Provides CVSS score and technical description.
• Microsoft SMB Signing Policy Guidance — Recommended mitigation against NTLM relay.
• MITRE ATT&CK Technique T1557.001 — Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay, relevant to the attack TTPs.

Frequently Asked Questions

What is NTLM reflection?

NTLM reflection is an attack where an attacker captures a victim's NTLM authentication attempt and replays it back to the same or another service, tricking the service into authenticating the attacker as the victim. CVE-2025-53704 specifically allows this reflection in the Windows SMB client.

Does CVE-2025-53704 require the attacker to be on the same network?

Yes, the attacker must be able to intercept network traffic, typically on the same LAN segment. However, phishing can lure victims to external malicious SMB servers, so the attacker may be remote.

Can SMB signing prevent this attack?

Enabling SMB signing can prevent NTLM relay attacks, but CVE-2025-53704 may bypass signing in certain configurations. Patching is the only guaranteed fix.

How do I know if I'm affected?

Check your Windows version against the affected list and verify if the June 2025 updates are installed. Use the Microsoft Update Catalog or Windows Update for patch status.

What should I do if I can't patch immediately?

Apply mitigations such as restricting NTLM outbound traffic, enabling SMB signing, and blocking SMB at the firewall. Monitor for suspicious SMB connections using the Sigma rule provided.

Is there a public exploit available?

Microsoft and CISA have confirmed active exploitation, but public exploit code may not be widely available. Assume exploitation is possible and act accordingly.

Need expert help with this?

CybernytronX can help you assess your exposure to NTLM relay vulnerabilities like CVE-2025-53704. Our penetration testing services simulate real-world attacks to identify weaknesses, and our SOC build-out services implement continuous monitoring. For proactive defense, explore our Ethereon AI threat detection platform. Contact us to schedule a security assessment today.