This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 5.3.
ZDI-26-708: (0Day) Microsoft Windows HTTP Proxy Privilege Escalation Vulnerability
About this summary. This is a short, independently written summary of an article first published by Zero Day Initiative. Cyber Security News did not report or verify the underlying story. Read the original: http://www.zerodayinitiative.com/advisories/ZDI-26-708/
Source attribution: headline and facts are from Zero Day Initiative (zerodayinitiative.com). Summary method: excerpt of the source description. See our source attribution policy and corrections policy.
Related coverage
A week in security (September 7 – September 13)
Here’s what we’ve covered in the last seven days on Malwarebytes Labs: Crypto customers targeted by scammers after email marketing provider breach Android malware…
Microsoft’s Patching
Once a month, Microsoft pushes a security update to all Windows users. Tomorrow’s is a new record: Microsoft’s patch for September is a doozy, with a record number of…
Credentials Are Still the Shortest Path In
How Brutus grew into an engine that finds your identities, tests them everywhere they’re accepted, and remembers what it confirms. An attacker rarely needs a novel…
Bypassing Windows authentication reflection mitigations for SYSTEM shells - Part 1
Il y a un an, les vulnérabilités de réflexion d'authentification ont refait surface comme un vecteur d'attaque puissant, à travers la découverte de la CVE-2025-33073 par…
On the clock: Escaping VMware Workstation at Pwn2Own Berlin 2025
Lors du Pwn2Own Berlin 2025, nous avons exploité VMware Workstation en abusant d'un Heap-Overflow dans l'implémentation de son contrôleur PVSCSI. L'allocation vulnérable…
NightEagle targets Russian companies
Over the past year, our Global Emergency Response Team (GERT) has investigated several incidents involving the NightEagle group (also tracked as APT-Q-95). This group…