Windows NTLM CVE-2026-50508

Exploitation requires the attacker to have network reachability to a vulnerable Windows host that performs NTLM authentication, and the ability to either passively observe or actively coerce an NTLM exchange - typical preconditions for NTLM relay/spoofing attacks. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, no user interaction, and low attack complexity against network-reachable services, so any environment where NTLM is still enabled on SMB, HTTP/WebDAV, RPC, or LDAP endpoints is in scope. Exploitation is limited where NTLM has been disabled or restricted via GPO, where SMB signing and LDAP channel binding are enforced (defeating relay), where the host is behind a firewall blocking SMB/RPC from untrusted networks, or where Kerberos-only authentication has been mandated.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N) signals a network-reachable, low-complexity, unauthenticated disclosure with high confidentiality impact, which justifies the 7.5 score. However, real-world urgency signals diverge: EPSS is only 0.08% (23rd percentile), CISA SSVC reports Exploitation=none and Automatable=no with only partial technical impact, and no KEV entry exists. This is a meaningful pre-positioning vulnerability for adversaries who can relay or replay disclosed material for NTLM spoofing/relay, but it is not currently a fire-drill: prioritize patching alongside standard Microsoft monthly cadence for domain controllers and any internet-exposed Windows hosts, with elevated urgency where NTLM remains broadly used. Note one discrepancy: CVSS reports I:N while the description specifies spoofing - spoofing is typically an integrity impact, so the assigned vector may understate the integrity dimension; verify with Microsoft's MSRC advisory.

An attacker on the same network (or able to coerce an outbound NTLM authentication via techniques like PetitPotam-style RPC calls, malicious UNC paths in documents, or rogue captive portals) induces a target Windows host to negotiate NTLM with attacker-controlled infrastructure. The NTLM exchange leaks sensitive material that the attacker uses to spoof the victim's identity to another network service, enabling lateral movement or unauthorized access under the victim's credentials. No public exploit identified at time of analysis, but the technique class (NTLM coercion + relay) is well established in offensive tooling such as Responder, ntlmrelayx, and PetitPotam.