PT-2026-2730 · Microsoft · Windows Ntlm+1

Bodyrotx + 1 · Published 2026-01-13 · Updated 2026-01-13 · CVE-2026-20925

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Windows NTLM (affected versions not specified)

Description An issue exists within Windows NTLM that allows for external control of file names or paths. This can enable an unauthorized attacker to perform spoofing over a network.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-73

Related Identifiers

BDU:2026-00431

CVE-2026-20925

Affected Products

Windows

Windows Ntlm

References · 7

• https://bdu.fstec.ru/vul/2026-00431 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-20925 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20925 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-20925 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-20925 · Security Note
• https://osv.dev/vulnerability/CVE-2026-20925 · Vendor Advisory
• https://twitter.com/CVEnew/status/2011181545776898141 · Twitter Post