Topic starter
22/01/2026 3:17 pm
TL;DR: A low-privileged domain user can still be turned into SYSTEM on vulnerable domain controllers by chaining coerced authentication with NTLM relay, bypassing channel binding and LDAP signing safeguards, according to CrowdStrike. The practical lesson is that hardening alone is not enough when identity flows remain relayable and session trust is weak.
Editorial analysis by NHI Mgmt Group, based on content published by CrowdStrike: “From Domain User to SYSTEM: Analyzing the NTLM LDAP Authentication Bypass Vulnerability (CVE-2025-54918)”.
Key questions
Q: What breaks when NTLM is still enabled in Active Directory?
A: NTLM preserves a replayable trust path that attackers can abuse once they obtain cached hash material from a compromised endpoint.
Q: Why do channel binding and LDAP signing not fully stop relay attacks?
A: They assume the authentication exchange reaches the intended server intact.
Q: How can security teams tell whether Active Directory relay protections are actually working?
A: Look for evidence that privileged authentication paths cannot be coerced into outward requests and then reused against LDAP or LDAPS.
Practitioner guidance
- Validate LDAP and LDAPS relay resistance Test domain controller authentication paths for channel binding, LDAP signing, and any accepted relay target combinations that still permit redirected authentication.
- Map coercible authentication sources Inventory Windows services and protocols that can be induced to authenticate outward, including spooler-related paths and other callable interfaces on privileged hosts.
- Prioritise domain controller hardening Remove or constrain legacy NTLM-dependent paths on domain controllers before they become the relay endpoint for coerced machine authentication.
Bottom line: NTLM relay still matters because it can turn a legitimate authentication exchange into an escalation path when coercion is possible.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
08/10/2026 4:19 pm
Authentication trust is only as strong as the session path that carries it. This article shows that identity controls built around signing and binding can fail when the authentication exchange itself is coerced and replayed. The vulnerability is not merely weak configuration, but the assumption that the original requester and the receiving service remain bound together. For Active Directory teams, that means runtime relayability matters as much as hardening posture.
A question worth separating out:
Q: Should organisations remove NTLM entirely or keep it with compensating controls?
A: If NTLM remains necessary, organisations should treat it as a bounded exception with strong enforcement around signing, binding, and service exposure. Where relayable paths exist on domain controllers, compensating controls may not be enough because the protocol itself can still be shaped into an escalation channel.
👉 Read our full editorial: NTLM relay and coerced authentication expose Active Directory trust gaps