Loading vulnerability…
Windows SMB Server Authentication Reflection Privilege Escalation
CVE-2025-58726 is an improper access control vulnerability in Windows SMB Server that allows an authenticated, low-privileged attacker to elevate privileges over a network. An attacker can execute a specially crafted script to coerce a victim machine into authenticating to an attacker-controlled SMB server and reflect that authentication back to the victim. This variant of CVE-2025-33073 requires a suitable ghost Service Principal Name (SPN) on the target or the ability to add an SPN to the target machine account. Successful exploitation can grant SYSTEM privileges. Microsoft rated the vulnerability Important, with a CVSS v3.1 base score of 7.5.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can elevate an authenticated, low-privileged attacker to SYSTEM on the victim machine, enabling arbitrary command execution with extensive access to local data and security settings. The resulting compromise can substantially affect confidentiality, integrity, and availability.
If you can’t patch tonight, do this now.
As defense in depth, review and remove unnecessary ghost or unused SPNs, restrict permissions to modify target machine-account SPNs, and limit outbound SMB connections to trusted servers. These measures reduce the identified prerequisites or authentication-coercion paths but are not a substitute for installing the security update.
Patch, then assume compromise.
Install the applicable October 2025 Microsoft Windows security update addressing CVE-2025-58726, or a superseding cumulative update. The fix changes SMB Server handling of local authentication connections to require that they originate from a local IP address. Product-specific fixed builds and KB identifiers are not available in the supplied information.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.