Windows HTTP proxy / NCSI coercion ZDI-26-708 (0-day): machine-account NTLM via user proxy — Microsoft declined servicing
Trend Micro Zero Day Initiative advisory ZDI-26-708 / ZDI-CAN-29849 (published 16 September 2026; CVSS 5.3 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) documents an unpatched Microsoft Windows privilege-escalation issue in HTTP proxy authentication handling. A low-privileged local attacker who can change the user proxy setting to an attacker-controlled server can coerce NTLM authentication in the machine-account context (commonly via Network Connectivity Status Indicator / WinHTTP connectivity checks running as NETWORK SERVICE). Microsoft acknowledged the report (May 2026), initially indicated a September fix, then on 31 August 2026 said the issue did not meet the Windows security servicing bar; ZDI published as a 0-day on 16 Sep. No CVE assigned. ITRESIT Labs (28 Sep) describes a pentest chain using the coercion into AD CS Web Enrollment relay when EPA/HTTPS are not enforced — that chain is environmental, not part of ZDI’s scored impact. Primary: ZDI-26-708; technical write-up: ITRESIT 28 Sep.
- Product
- Microsoft Windows (HTTP proxy authentication / NCSI connectivity checks)
- Versions
- Affected: Windows installations where a low-privileged user can set an HTTP proxy consumed by system connectivity checks (ZDI: Windows). No Microsoft security update; no CVE. ZDI disclosed 16 Sep 2026 after vendor declined servicing (31 Aug 2026).
- CVSS
- 5.3
- Exploited in Australia?
- unknown
- Patch to
- No Microsoft patch. Harden AD CS Web Enrollment (require HTTPS + Extended Protection for Authentication); monitor unexpected user-proxy changes and MACHINE$ HTTP/NTLM to non-corporate proxies; restrict who can set system-affecting proxy settings; treat ZDI-26-708 as unpatched local coercion until Microsoft revisits servicing.
Primary: ZDI-26-708 — Microsoft Windows HTTP Proxy Privilege Escalation (0-day, 16 Sep 2026) · Vendor: Microsoft MSRC — Windows Security Servicing Criteria (issue declined for servicing) · ITRESIT Labs — NCSI / proxy coercion to AD CS relay chain (28 Sep 2026)