Researchers at SpecterOps have discovered a novel NTLM relay bypass technique that affects both LDAP and SMB signing. Previously thought to protect against NTLM relay attacks, these protocols can still be targeted through re-authentication on an attacker-controlled connection. While signing is enforced, it occurs with the attacker’s known session key. Microsoft quietly patched SMB in September 2026 and LDAP in October, highlighting a significant vulnerability in widely used authentication mechanisms.