PT-2026-24331 · Microsoft · Windows

Guillaume André + 1 · CVE-2026-26128 · Published 2026-03-10 · Updated 2026-07-12

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Windows 10 Version 1607 Windows Server 2025 Windows Server 2011

Description Improper authentication in the Windows SMB Server allows an authorized attacker to elevate privileges locally. The issue involves a Kerberos reflection bypass, which can enable an attacker to gain SYSTEM privileges on most Windows builds. Approximately 756,600 instances were identified globally.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2026-02973

CVE-2026-26128

Affected Products

Windows

References · 22

• https://bdu.fstec.ru/vul/2026-02973 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-26128 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26128 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26128 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26128 · Security Note
• https://msrc.microsoft.com/update-guide/advisory/CVE-2026-26128 · Vendor Advisory
• https://synacktiv.com/en/publications/bypassing-windows-authentication-reflection-mitigations-for-system-shells-part-1 · Note
• https://t.me/avleonovcom/1637 · Telegram Post
• https://vicarius.io/vsociety/posts/cve-2026-26128-detection-script-improper-authentication-in-windows-smb-server · Note
• https://vicarius.io/vsociety/posts/cve-2026-26128-mitigation-script-improper-authentication-in-windows-smb-server · Note
• https://twitter.com/denizhalilT/status/2074373345718776081 · Twitter Post
• https://twitter.com/zoomeye_team/status/2074019700452041108 · Twitter Post
• https://twitter.com/Daily_CyberSec/status/2073936274596016481 · Twitter Post
• https://twitter.com/moton/status/2074151749519352211 · Twitter Post
• https://reddit.com/r/CVEWatch/comments/1t58epd/top_10_trending_cves_06052026 · Reddit Post