Improper authentication in Windows SMB Server

CVE-2026-24294 is an improper-authentication flaw in the Windows SMB Server (srv2.sys / srvnet.sys path) that lets a local, low-privileged user coerce the SMB session layer into treating them as an already-authenticated principal. Practically, that means a standard user session on a Windows host can obtain SMB pipe access that should require administrative privilege — the classic path to \\.\pipe\svcctl or \\.\pipe\lsass handles that end in SYSTEM. Affected builds per the March 2026 Patch Tuesday advisory span Windows 10 22H2, Windows 11 22H2/23H2/24H2, and Windows Server 2019/2022/2025, including Server Core.

Microsoft's HIGH / 7.8 rating tracks the CVSS math honestly: AV:L/AC:L/PR:L/UI:N with CIA all High describes a local privilege escalation, not a wormable remote. The vendor label matches reality — this is not another EternalBlue and should not be treated as one, but it is a clean SYSTEM primitive once an attacker has any foothold, which is exactly what post-phish and post-RCE chains need. HIGH stays.

Why this verdict

• Local-only vector caps upside: AV:L/PR:L means attacker must land code first — not a wormable remote like MS17-010
• Role multiplier — member servers: chain succeeds, ends at SYSTEM on the local box + machine account TGT; blast radius = single host + adjacent silver-ticket abuse
• Role multiplier — domain controllers: SYSTEM on a DC equals DA; since SMB Server is default-on every DC, the canonical high-value role is in-scope and this alone floors the verdict at HIGH
• Role multiplier — Hyper-V / file servers / backup targets: SYSTEM enables VM extraction, shadow-copy tampering, or backup deletion — fleet-adjacent impact
• Public PoC compounds urgency: SmbPipeElevation is weaponizable today; commodity ransomware crews reuse LPE primitives within weeks
• No mass-exploitation vector: no scanner/Shodan surface; exploitation requires prior initial access which limits the exposure population

Why not higher?

CRITICAL is reserved for pre-auth or network-reachable chains. This CVE cannot be reached without existing code execution on the host, and there is no evidence of chaining to a remote primitive. Even on domain controllers, the attacker needs a prior foothold — DA is a two-step story, not one-shot.

Why not lower?

MEDIUM would ignore the domain-controller role multiplier: SMB Server is default-on for every DC, so any post-exploitation LPE that yields SYSTEM on a DC ends in DA. Combined with a public PoC and full CIA impact, downgrading below HIGH would understate the risk to Windows-heavy fleets.

1. Deploy the March 2026 cumulative update to all Windows Servers — KB5035853 (Server 2022) and equivalents fix the pipe ACL check. Per noisgate mitigation SLA for HIGH, deploy within 30 days; prioritize domain controllers, Hyper-V hosts, and file/backup servers first.
2. Enable LSA Protection and Credential Guard where not already on — Blocks the LSASS-read path even if the pipe bypass succeeds, shrinking the step-4 impact. Roll out via GPO / Intune within 30 days on all Windows 10/11 and Server 2019+ endpoints.
3. Restrict named-pipe enumeration via NullSessionPipes and RestrictNamedPipes — Reduces the reachable privileged-pipe surface for non-privileged callers. Push GPO Computer Configuration → Windows Settings → Security → Local Policies → Security Options → Network access within 14 days as a bridge control.
4. Tune EDR to alert on service creation from non-service parents — Event ID 7045 with a non-services.exe grandparent is the loudest signal of step-4 abuse. Deploy detection rule within 7 days of receiving this advisory.

Run on each target Windows host as a local administrator (or via a remote PowerShell session / Intune script). Example: .\Check-CVE-2026-24294.ps1. Requires read access to the OS build number and installed updates via Get-HotFix and Get-CimInstance.

#requires -Version 5.1
# Check-CVE-2026-24294.ps1
# Determines whether the local host is patched against CVE-2026-24294.
# Output: VULNERABLE / PATCHED / UNKNOWN

$ErrorActionPreference = 'Stop'

try {
    $os = Get-CimInstance -ClassName Win32_OperatingSystem
    $build = [int]$os.BuildNumber
    $ubr = (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').UBR

    # Map of build -> minimum UBR that contains the March 2026 fix
    $fixed = @{
        19045 = 5011   # Win10 22H2 - KB5035845
        20348 = 2402   # Server 2022 - KB5035853
        22621 = 3296   # Win11 22H2 - KB5035849
        22631 = 3296   # Win11 23H2 - KB5035849
        26100 = 348    # Server 2025 / Win11 24H2 - KB5035858
        17763 = 5576   # Server 2019 - KB5035855
    }

    if (-not $fixed.ContainsKey($build)) {
        Write-Output "UNKNOWN: unrecognized build $build.$ubr"
        exit 2
    }

    if ($ubr -ge $fixed[$build]) {
        Write-Output "PATCHED: build $build.$ubr meets fix floor $($fixed[$build])"
        exit 0
    } else {
        Write-Output "VULNERABLE: build $build.$ubr below fix floor $($fixed[$build])"
        exit 1
    }
} catch {
    Write-Output "UNKNOWN: $($_.Exception.Message)"
    exit 2
}

Sources

1. Microsoft MSRC — CVE-2026-24294
2. NVD entry
3. CISA KEV catalog
4. FIRST EPSS
5. ZDI advisory ZDI-CAN-24571
6. Microsoft — LSA Protection guidance
7. Microsoft — Credential Guard
8. itm4n research blog