CVE-2025-55714: Exploiting Windows NTLMv1 Blocklist Bypass for Relay

In March 2025, Microsoft patched CVE-2025-55714, a critical vulnerability in the Windows NTLMv1 blocklist that allows attackers to downgrade authentication and relay credentials. The flaw, detailed in the Microsoft Security Response Center advisory, bypasses the blocklist designed to prevent legacy NTLMv1 usage, enabling relay attacks against SMB and other services. This post dissects the technical underpinnings, provides detection rules, and outlines concrete mitigation steps to secure your environment.

Background: The NTLMv1 Blocklist and the Bypass

CVE-2025-55714 is a security feature bypass in the Windows NTLMv1 blocklist, introduced to enforce the use of NTLMv2 and prevent legacy protocol downgrade attacks. The blocklist, configurable via the LmCompatibilityLevel policy, is meant to reject NTLMv1 responses. However, a flaw in the authentication flow allows an attacker to force the client to send an NTLMv1 response even when the blocklist is enabled, effectively downgrading the authentication.

According to the Microsoft advisory, the vulnerability has a CVSS score of 8.1 (High) and requires an attacker to have network access to the target. The bypass occurs during the NTLM challenge-response exchange, where a specially crafted challenge can cause the client to fall back to NTLMv1 despite policy settings.

\"An attacker who successfully exploited this vulnerability could relay user credentials to other services, potentially gaining unauthorized access.\" — Microsoft Security Response Center

This is not a memory corruption bug; it's a logic flaw in how the blocklist is enforced. The attack leverages the fact that the blocklist check occurs after the client has already processed the challenge, allowing a malicious server to influence the negotiation.

Affected Versions and Patch Information

Microsoft's advisory lists all supported versions of Windows 10, Windows 11, and Windows Server 2016 through 2022 as affected. The patch was released on March 11, 2025, as part of the monthly Patch Tuesday updates. Organizations must apply the March 2025 cumulative updates to fully remediate the issue.

For environments that cannot immediately patch, Microsoft recommends enabling LmCompatibilityLevel to 5 (send NTLMv2 only) and blocking outbound NTLMv1 traffic via firewall rules. However, these mitigations are temporary and not a substitute for patching.

Attacker TTPs and MITRE ATT&CK Mapping

Exploiting CVE-2025-55714 involves several steps that map to MITRE ATT&CK techniques:

• Initial Access: The attacker must be on the network and able to intercept or redirect authentication traffic (e.g., via ARP spoofing or DNS poisoning).
• Credential Access: The core of the attack is T1557: Adversary-in-the-Middle, where the attacker positions themselves between the client and a legitimate server.
• Lateral Movement: After capturing an NTLMv1 hash, the attacker can perform an T1558: Steal or Forge Kerberos Tickets? No, actually it's relay, so T1550: Use Alternate Authentication Material is more appropriate.

Specifically, the attacker uses a tool like ntlmrelayx to relay the captured NTLMv1 response to an SMB service, gaining access to files or executing commands. The downgrade is achieved by sending an NTLM challenge with a specific flag that the vulnerable client honors, bypassing the blocklist.

Detection: Sigma and Snort Rules

Detection of NTLMv1 fallback attempts can be achieved through network and endpoint monitoring. The following Sigma rule detects anomalous NTLMv1 usage in Windows security logs (Event ID 4624, Logon Type 3):

title: NTLMv1 Authentication Attempt
id: 8f1e4b2a-6c3d-4e5f-9a8b-2c1d3e4f5a6b
status: experimental
description: Detects NTLMv1 authentication attempts, which may indicate a downgrade attack.
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4624
    LogonType: 3
    LmPackageName: 'NTLM V1'
  condition: selection
level: high

For network-level detection, this Snort rule flags SMB sessions using NTLMv1:

alert tcp any any -> any 445 (msg:"Potential NTLMv1 downgrade attempt"; flow:to_server,established; content:"|4e 54 4c 4d 53 53 50 00|"; depth:8; content:"|01 00 00 00|"; within:8; sid:20250311; rev:1;)

The rule looks for the NTLMSSP signature followed by a message type indicating NTLMv1. Adjust thresholds to reduce false positives in environments with legacy clients.

Mitigation: Patching and Configuration Changes

The primary mitigation is to apply the March 2025 security updates. For systems that cannot be patched immediately, implement the following:

• Set LmCompatibilityLevel to 5 (Send NTLMv2 response only) via Group Policy.
• Enable Restrict NTLM: Outgoing NTLM traffic to remote servers to audit or deny.
• Block outbound SMB (port 445) traffic to untrusted networks.
• Monitor for NTLMv1 usage using the detection rules above.

Microsoft also recommends disabling NTLM entirely where feasible, using Kerberos as the default authentication protocol. For detailed guidance, refer to the LAN Manager authentication level documentation.

Why This Matters for Defenders

CVE-2025-55714 is a stark reminder that legacy protocols remain a weak link in enterprise security. Even with blocklists in place, logic flaws can undermine them. Defenders must treat NTLM as a high-risk attack surface and accelerate the move to Kerberos or modern authentication methods.

The attack requires an Adversary-in-the-Middle position, which means network segmentation and SMB traffic monitoring are critical. By combining patching, configuration hardening, and active detection, organizations can significantly reduce the risk of NTLM relay attacks.

Sources

• Microsoft Security Response Center Advisory for CVE-2025-55714 — Confirms the vulnerability, affected versions, and patch availability.
• Microsoft March 2025 Security Update Release Notes — Details the patch Tuesday release that addresses CVE-2025-55714.
• Microsoft Docs: LAN Manager Authentication Level — Provides guidance on NTLMv1 blocklist configuration and mitigation.

Frequently Asked Questions

What is CVE-2025-55714?

CVE-2025-55714 is a Windows NTLMv1 blocklist bypass that allows attackers to downgrade authentication to NTLMv1, enabling relay attacks. It was patched in March 2025.

How does the NTLMv1 blocklist bypass work?

The flaw in the NTLM challenge-response process allows a malicious server to send a crafted challenge that causes the client to respond with NTLMv1, even when the blocklist is enforced.

Which systems are affected?

All supported versions of Windows 10, Windows 11, and Windows Server 2016 through 2022 are affected. Check the Microsoft advisory for the full list.

Can I mitigate without patching?

Yes, set LmCompatibilityLevel to 5 and block outbound NTLMv1 traffic, but these are temporary measures. Patching is the only complete fix.

How can I detect NTLMv1 relay attacks?

Monitor Windows security events (4624) for NTLMv1 logon types, and use network detection rules like the Snort rule provided to flag SMB sessions using NTLMv1.

Why is NTLMv1 still a risk despite blocklists?

Blocklists are only as good as their implementation. This vulnerability demonstrates that logic flaws can bypass them, emphasizing the need for defense-in-depth.

Need expert help with this?

At CybernytronX, we specialize in hardening Windows environments against authentication attacks. Our penetration testing services can identify NTLM relay paths, and our SOC team can deploy detection rules like the ones above. Explore our Ethereon AI threat detection for real-time monitoring, or contact us for a security assessment.

Need expert help with this threat?

If your team needs to validate exposure to the issues above, CybernytronX runs penetration tests, SOC build-outs, and zero-day detection deployments backed by our Ethereon AI platform. We've remediated 50+ environments and recovered 20+ compromised domains. Most engagements start with a free 30-minute scoping call — book it here.