CVE-2025-54918 NTLM Auth With Empty Username Anomaly

Tim Peck@timpeck

•updated Oct 23, 2025•2•0•179

Detects an NTLM authentication attempt with an empty username field. This is a key indicator of the NTLM LDAP authentication bypass vulnerability (CVE-2025-54918), where an attacker coerces a SYSTEM account authentication and relays it to LDAP.