tag
Smb
Windows Server 2025 Local NTLM Reflection LPE via SMB Arbitrary Port + PetitPotam (CVE-2026-24294)
Windows 11 24H2 / Server 2025 introduced an SMB client capability allowing connections to arbitrary TCP ports via net use \\host\share /tcpport:PORT. Combined with SMB2 session multiplexing, this enables a local NTLM reflection attack: a low-privileged local…
Samba spoolss Print Job Command Injection RCE (CVE-2026-4480)
This PoC targets a flaw in Samba's spoolss print spooler RPC interface where a submitted print job's document name/content is not safely handled, allowing an attacker who can open a writable printer/share to inject a shell command that gets executed on the…
curl SMB Connection-Reuse Use-After-Free (CVE-2026-3805)
libcurl's SMB protocol handler stores a request-scoped req->path pointer that points into memory owned by a temporary "needle" connection object used during connection-cache lookup (smbc->share). When a second SMB transfer to the same server reuses an…
Apache Solr UNC Path Validation Bypass to RCE (CVE-2026-22444)
CVE-2026-22444 affects Apache Solr's "create core" admin API on Windows deployments running in standalone mode. Path validation (assertPathAllowed()) is only performed after the CoreDescriptor constructor has already triggered filesystem/network operations…
Windows NTLM Hash Disclosure via File Explorer - CVE-2025-24054
CVE-2025-24054 is a zero-click NTLMv2-SSP hash disclosure vulnerability in Windows File Explorer. When a user opens a ZIP archive containing a crafted .searchConnector-ms file, Windows Explorer automatically resolves an embedded UNC path during file preview,…