CVE-2026-24294 PetitPotam EFS RPC NTLM Coercion Process Execution

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

Detects the execution of known PetitPotam exploitation tools or the use of command line arguments related to EFS RPC functions (e.g., EfsRpcOpenFileRaw) used to coerce authentication via NTLM reflection.