Microsoft Windows HTTP Proxy Vulnerability Allows Privilege Escalation
A local privilege escalation vulnerability in Microsoft Windows, ZDI-26-708, allows attackers to disclose NTLM responses and gain elevated privileges by manipulating HTTP proxy settings.
Zero Day Initiative (ZDI) has disclosed a critical privilege escalation vulnerability in Microsoft Windows, identified as ZDI-26-708. This flaw permits local attackers, who have already achieved low-privilege code execution on a target system, to escalate their privileges to a higher level.
The vulnerability stems from how Windows handles authentication requests to HTTP proxy servers. By configuring the system's proxy settings to point to a malicious server, an attacker can trick the system into disclosing NTLM authentication responses. Crucially, these responses are disclosed in the context of the machine account, which often possesses broader permissions than a standard user account.
Successful exploitation of this vulnerability allows an attacker to leverage the compromised machine account credentials to access resources that would normally be protected from a low-privileged user. This could include sensitive system files, network shares, or other services that rely on machine authentication for access control.
The CVSS score for this vulnerability is rated at 5.3, classifying it as moderate severity. While not reaching the critical threshold, the potential for privilege escalation, especially when combined with initial code execution, makes it a significant concern for system administrators.
According to the disclosure timeline, ZDI initially reported the vulnerability to Microsoft on May 7, 2026. Microsoft acknowledged the report and initially indicated that a fix would be included in their September release. However, by August 31, 2026, Microsoft communicated that the vulnerability did not meet their criteria for security servicing. Following this, ZDI notified Microsoft of their intention to publish an advisory as a zero-day, leading to the coordinated public release on September 16, 2026.
Given the nature of the vulnerability, which involves manipulating network proxy settings and intercepting authentication responses, the primary mitigation strategy recommended by ZDI is to restrict interaction with the affected product. This implies careful monitoring of network traffic and potentially limiting the ability of users or processes to arbitrarily change proxy configurations.
This vulnerability was discovered by Peter Gabaldon, who is credited in the advisory. The disclosure highlights an ongoing trend of vulnerabilities being found in core Windows components that, while not always critical in isolation, can be chained together by attackers to achieve significant system compromise.
As Microsoft did not deem the vulnerability severe enough for a security servicing fix, users are advised to implement the suggested mitigation strategies. This situation underscores the importance of proactive security research and the role of organizations like ZDI in bringing such issues to light, even when vendors do not prioritize immediate patching.