srl
SMB
Server Message Block (SMB) is a client-server protocol that regulates access to files, directories, and other network resources. An SMB server exposes arbitrary parts of its local filesystem as shares, with access governed by ACLs. SMB runs on TCP port 445 by default (NetBIOS over TCP/139 is legacy).
2025–2026 context: SMB remains the single most valuable protocol in an AD environment — it is the file-access layer, the relay target, and the coercion transport. Three developments define the current landscape. CVE-2025-33073 resurrected NTLM reflection and removed the admin prerequisite for relay-based SYSTEM access. SMBGhost (CVE-2020-0796) is still in CISA’s KEV catalog, with estates still negotiating SMB 3.1.1 compression — one crafted packet away from Ring 0. And 2026 produced a cluster of SMB Server privilege-escalation CVEs (race conditions, auth-algorithm flaws, unbounded resource allocation) that are network-reachable with any authenticated account.