NTLM relay past required signing: SpecterOps and Blackfield re-authenticate a signed LDAP or SMB session with a relayed victim identity, and Microsoft fixed it in the September and October 2026 updates

SpecterOps and Blackfield show that NTLM relay to a server that requires signing works again when the attacker first owns a signed session and then re-authenticates it with the victim's identity, so the session keeps the attacker's signing key. For LDAP, the attacker signs a session to a domain controller with valid credentials or, where accepted, an anonymous NTLM context, coerces a victim over SMB, and sends the victim's relayed authentication with a malicious LDAP modification in one SASL record signed with the attacker's key; the controller checks the signature once, switches to the victim's identity and runs the modification with the victim's rights (SpecterOps, 2026-10-23). The tested controller enforced LDAP signing and channel binding and the attack still worked over 389/TCP; the demonstration writes the resource-based constrained delegation attribute, and relaying a domain controller's machine account to another controller leads to DCSync and domain compromise (SpecterOps, 2026-10-23). Blackfield shows the SMB counterpart: a server keeps the original signing key on re-authentication without checking that the identity matches, so on any host that requires SMB signing, domain controllers included, a relayed privileged authentication yields a privileged session still signed with the low-privilege key, provided the attacker can capture or coerce that authentication (Blackfield, 2026-10-21).

SpecterOps reported the LDAP flaw to Microsoft on 2026-10-06, received no response, and says the fix shipped in the 2026-10-13 cumulative update, KB5126646, while the SMB variant was patched quietly in September 2026 (KB5122882) (SpecterOps, 2026-10-23). KB5126646 is the October update for Windows Server 2025 and KB5122882 the September update for Windows Server 2022 (Microsoft, 2026-10-13; Microsoft, 2026-09-08), so each release needs its own cumulative update of the month. Blackfield found no CVE or KB note for the SMB change, says similar changes seem to have reached the other supported versions in the following weeks without having traced every build, and warns that one or two end-of-life versions may never receive it (Blackfield, 2026-10-21). Both publish tooling; neither reports use in attacks (SpecterOps, 2026-10-23; Blackfield, 2026-10-21).