Security researcher Stiv Kupchik of Akamai has published proof-of-concept exploit code for CVE-2024-43532 (CVSS 8.8), an elevation of privilege vulnerability in Microsoft Windows Remote Registry (WinReg). The flaw stems from an unsafe fallback mechanism in the Windows RPC client when invoking registry functions such as RegConnectRegistry. While remote registry operations natively establish secure Server Message Block (ncacn_np) transport, blocking SMB port 445 coerces the client into downgrading to obsolete dynamic TCP transport (ncacn_ip_tcp) using the degraded RPC_C_AUTHN_LEVEL_CONNECT authentication level, which lacks message integrity verification or packet signing.

Network adversaries can weaponize this unauthenticated fallback to execute NTLM relay attacks against Active Directory Certificate Services (ADCS) endpoints, requesting user or machine authentication certificates and escalating directly to Domain Administrator. The vulnerability impacts Windows 10, Windows 11, and Windows Server 2008 through 2022. Microsoft patched the client-side transport logic in the October 2024 Patch Tuesday rollout, and researchers have released automated detection scripts and YARA rules to detect unpatched binaries initiating vulnerable WinReg bindings.

Why it matters:

• Bullet 1 — Technical & Architecture Risk: Forcing MS-RPC protocol fallback circumvents SMB signing and channel integrity checks, downgrading authentication to an unverified state that allows attackers to relay high-privilege machine accounts to ADCS web endpoints without triggering authentication mismatch alerts.
• Bullet 2 — Strategic & Defender Imperative: Because the vulnerability resides in client-side RPC runtimes, patching servers alone is insufficient. Enterprise defenders must prioritize workstation patching, enforce Extended Protection for Authentication (EPA) across all ADCS services, and accelerate NTLM deprecation across the forest.