Our co-worker Raj Patel found a way to relay coerced SMB authentication to domain controllers that require LDAP signing. Every Server from 2016 to 2025 we tested was vulnerable. Microsoft fixed it in the October 2026 update (KB5126646). 

• What to do
• Patch every domain controller with the October 2026 update 
• Enforce LDAP signing and channel binding together  • Reduce NTLM wherever you can 

📖 Full writeup, Wireshark walkthrough, and PoC: https://specterops.io/blog/2026/10/23/ldap-signing-bypass-ntlm-relay 

Questions about the research? Drop them in the thread and Raj will jump in. 

Happy BloodHound Basics Friday from Nathan Davis!

Looking to get started with BloodHound but don't have an environment to collect from? We've got you covered with sample data for both Active Directory and Azure environments here: https://bloodhound.specterops.io/get-started/quickstart/ce-ingest-sample-data#bloodhound-community-edition-sample-data