Zero‑Day Local Privilege Escalation in Windows HTTP Proxy (CVE‑2026‑XXXXX)
What Happened — A newly disclosed vulnerability (CVSS 5.3) in Microsoft Windows allows a local attacker who can run low‑privileged code to modify the system’s HTTP proxy settings, force NTLM authentication to a malicious server, and then capture the machine‑account credentials. The captured NTLM hash can be used to elevate privileges and access resources normally restricted to higher‑privileged accounts. The flaw is tracked as ZDI‑26‑708 and will be patched in an upcoming September release.
Why It Matters for Trust & Control Assurance
- Continuous control‑assurance programs require evidence that privileged‑access controls and proxy configurations remain within approved baselines; this vulnerability shows how a seemingly benign setting can subvert those controls.
- Demonstrable monitoring of configuration drift and automated evidence collection (e.g., baseline compliance scans) provide the audit‑ready trail needed to prove that the privilege‑escalation control is operating as intended.
- Verisq’s Control Mapping capability can ingest proxy‑setting baselines, map them to the “Privilege Management” control objective, and generate continuous proof for frameworks such as NIST CSF 2.0 and ISO 27001.
Who Is Affected
- Enterprises running Microsoft Windows on desktops, laptops, or servers across all verticals (technology, finance, healthcare, etc.).
- Organizations that rely on NTLM authentication for internal services or legacy applications.
Recommended Actions
1. Restrict changes to system‑wide proxy settings through Group Policy or endpoint‑management tools.
2. Enable logging of proxy‑configuration changes and NTLM authentication events; correlate with privileged‑access monitoring.
3. Apply the forthcoming September security update as soon as it is released; in the interim, consider disabling HTTP proxy usage on high‑risk systems.
4. Validate that your continuous control‑assurance platform captures proxy‑setting state and privilege‑escalation alerts as evidence.
Source: Zero Day Initiative Advisory – ZDI‑26‑708
Technical Notes
- Attack Vector: Local exploitation via malicious proxy configuration (VULNERABILITY_EXPLOIT).
- CVSS Base Score: 5.3 (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
- Data Exposed: NTLM hash of the machine account, enabling lateral movement and privilege escalation.
- Mitigation (until patch): Limit proxy configuration changes to administrators and monitor NTLM traffic.