CVE-2026-20925: Windows NTLM Path Traversal Vulnerability

CVE-2026-20925 Overview

CVE-2026-20925 is a network spoofing vulnerability in Windows NTLM caused by external control of file name or path (CWE-73). This vulnerability allows an unauthorized attacker to perform spoofing attacks over a network, potentially leading to credential theft or unauthorized access to sensitive information.

Critical Impact

An attacker can exploit this NTLM vulnerability to capture or relay authentication credentials, enabling network-based spoofing attacks that could compromise user identities and sensitive data.

Affected Products

• Windows NTLM (specific affected versions not disclosed)

Discovery Timeline

• January 13, 2026 - CVE CVE-2026-20925 published to NVD
• January 13, 2026 - Last updated in NVD database

Technical Details for CVE-2026-20925

Vulnerability Analysis

This vulnerability exists in the Windows NTLM authentication protocol due to improper handling of externally controlled file names or paths. The flaw allows an attacker to manipulate file path references in a way that triggers NTLM authentication to an attacker-controlled server. When a victim's system attempts to access a specially crafted resource, it may automatically send NTLM credentials to the malicious server.

The attack requires user interaction, meaning the victim must be induced to access a malicious resource (such as opening a crafted file or clicking a link). While no authentication is required from the attacker's perspective, successful exploitation can result in high confidentiality impact, allowing attackers to capture NTLM hashes or relay authentication attempts.

Root Cause

The vulnerability stems from CWE-73 (External Control of File Name or Path), where the application fails to properly validate or sanitize file paths before using them in operations that may trigger NTLM authentication. This allows attackers to specify paths pointing to external resources under their control, causing the victim's system to initiate NTLM authentication handshakes with malicious servers.

Attack Vector

The attack is network-based and exploits the way Windows handles file path references that can trigger NTLM authentication. An attacker can craft malicious content containing UNC paths or other file references pointing to attacker-controlled servers. When a victim processes this content, their system automatically attempts NTLM authentication to the specified server, leaking credential hashes.

Common attack scenarios include:

• Malicious documents containing external resource links
• Specially crafted file paths in web content
• Phishing attacks leveraging file path manipulation to harvest credentials

Since no verified code examples are available for this vulnerability, security researchers should consult the Microsoft Security Response Center advisory for detailed technical information.

Detection Methods for CVE-2026-20925

Indicators of Compromise

• Outbound SMB connections (port 445) to unexpected or external IP addresses
• NTLM authentication attempts to non-corporate or unknown servers
• Unusual file access patterns involving UNC paths to external resources
• Network traffic containing NTLM handshakes with unrecognized endpoints

Detection Strategies

• Monitor SMB traffic for outbound connections to non-trusted IP ranges
• Implement network detection rules for NTLM authentication to external hosts
• Review Windows Security Event Logs for authentication events (Event ID 4624, 4625) with unusual target servers
• Deploy endpoint detection to identify processes initiating suspicious file path operations

Monitoring Recommendations

• Enable logging for outbound NTLM authentication attempts in Windows event logs
• Configure network monitoring to alert on SMB connections leaving the corporate network
• Implement behavioral analysis to detect applications triggering unexpected NTLM authentication
• Review DNS logs for lookups of unfamiliar hostnames that precede SMB connections

How to Mitigate CVE-2026-20925

Immediate Actions Required

• Apply the latest Microsoft security updates for affected Windows systems
• Review and restrict outbound SMB traffic at network perimeter firewalls
• Enable Extended Protection for Authentication (EPA) where supported
• Consider implementing NTLM blocking policies for external network traffic

Patch Information

Microsoft has released security updates to address this vulnerability. Administrators should apply the patches available through the Microsoft Security Update Guide for CVE-2026-20925. Organizations should prioritize patching systems that handle untrusted content or are exposed to external networks.

Workarounds

• Block outbound SMB (TCP port 445) traffic at the network firewall to prevent credential leakage
• Configure Windows Firewall to block outbound SMB connections to untrusted networks
• Disable NTLM authentication where possible and migrate to Kerberos-based authentication
• Implement network segmentation to limit the scope of potential credential relay attacks

# Block outbound SMB traffic via Windows Firewall (PowerShell)
New-NetFirewallRule -DisplayName "Block Outbound SMB" -Direction Outbound -LocalPort 445 -Protocol TCP -Action Block

# Alternatively, configure Group Policy to restrict NTLM usage
# Navigate to: Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options
# Set "Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers" to "Deny all"