Active Directory: Bypassing LDAP Signing and Compromising the Domain via NTLM Relay

SpecterOps researchers discovered a way to bypass LDAP Signing — a mechanism that protects the integrity of LDAP messages and was previously considered one of the primary defenses against NTLM Relay attacks. A flaw in reauthentication handling allowed LDAP operations to be performed with another user's privileges even when message signing was mandatory. The attack affected Windows Server domain controllers starting with version 2016, and Microsoft released a fix in October 2026.

To exploit the vulnerability, an attacker first establishes a signed LDAP connection to the domain controller using a session key known to the attacker. The attacker then coerces the target host into authenticating over NTLM via SMB and relays the authentication through the already-established LDAP connection. The key feature is that the reauthentication message and the malicious LDAP request are placed in a single signed SASL record. The domain controller verifies the signature using the original key, then switches the security context to the victim's account and executes the LDAP request with that account's privileges.

Exploiting the vulnerability allows an attacker to modify Active Directory objects on behalf of the compromised account without knowing its password. For example, the researchers demonstrated modifying the msDS-AllowedToActOnBehalfOfOtherIdentity attribute to carry out an RBCD attack. When a domain controller's authentication is relayed, this can lead to taking control of the controller, performing DCSync, and fully compromising the domain. The attack requires access to LDAP over port 389/TCP; this bypass does not apply to LDAPS.

Article: https://specterops.io/blog/2026/10/23/ldap-signing-bypass-ntlm-relay/