CVE-2026-24294 NTLM Reflection Bypass - Loopback NTLM Network Logon

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

Detects NTLM-authenticated network logons (Logon Type 3) originating from loopback IP addresses (127.0.0.1, ::1, or 0.0.0.0). This behavior is often associated with NTLM relay attacks or credential reflection bypass techniques where an adversary forces a local service to authenticate to itself to gain unauthorized access.