Microsoft Leaves 0-Day Open: Refuses Patch for HTTP Proxy Privilege Escalation

On September 16, 2026, Trend Micro disclosed ZDI-26-708, a zero-day vulnerability in Microsoft Windows HTTP Proxy that allows local privilege escalation. The story isn't the discovery itself, but the vendor's about-face: Microsoft had confirmed in June it would fix the flaw in the September Patch Tuesday, then on August 31 told ZDI the vulnerability "did not meet the bar for security servicing." The result: a documented 0-day with a CVSS of 5.3 and no fix in sight.

The Mechanism: From Hijacked Proxy to Machine Account NTLM

The flaw lies in the handling of authentication to HTTP proxy servers. As the ZDI advisory documents, an attacker who has already achieved low-privilege code execution on the target system can modify the proxy setting to point to a server under their control.

From that point, NTLM authentication requests generated by the system are directed to the malicious server, which captures them. The advisory specifies that NTLM responses are disclosed "in the context of the machine account." The brief classifies the vulnerability as privilege escalation.

The attack requires local access: it is not a remote vulnerability and does not enable initial system entry. It serves as a post-compromise tool in multi-user or terminal server environments, where an attacker already present seeks to expand privileges.

"By changing the proxy setting to point to a malicious server, an attacker can disclose NTLM responses in the context of the machine account." — ZDI Advisory ZDI-26-708

The Timeline of a Refusal: ~4 Months from Report to Disclosure

ZDI reported the vulnerability to Microsoft on May 7, 2026. The vendor acknowledged receipt the same day. On June 2, 2026, Microsoft confirmed it would release a fix in the September 2026 patch cycle.

On August 31, 2026, Microsoft informed ZDI the vulnerability "did not meet the bar for security servicing." The dossier does not reveal which specific criterion was invoked. What is documented is the outcome: no patch, advisory published as a 0-day on September 16, 2026.

The ZDI disclosure includes technical details on the vulnerable component, the proxy vector, and the NTLM mechanics. The brief shows no public exploit demonstrations or confirmations of exploitation in the wild. The full timeline shows a path marked by promise and retraction.

Why the CVSS 5.3 Doesn't Tell the Whole Story

The CVSS 5.3 score, drawn from the published ZDI table rather than the advisory body, places the vulnerability in the medium-low range. The rating reflects the local access prerequisite and attack complexity.

For defenders, the problem is the vector's combination with other lateral movement techniques. An attacker who has already compromised an endpoint finds in ZDI-26-708 a tool to elevate access in the context of the machine account.

The machine account holds higher privileges than a standard user. Capturing NTLM responses in this context opens escalation scenarios the CVSS score alone does not make obvious. The source does not specify whether Microsoft has provided or will provide alternative mitigations.

What to Do Now

The only operational guidance in the ZDI advisory is to limit interaction with the product. The source specifies no additional technical measures. For system administrators, this generality leaves wide room for assessment.

Organizations operating in multi-user environments should monitor proxy configurations on Windows systems. Any unauthorized changes to network settings represent a relevant indicator. Periodic verification of proxy settings, especially on terminal servers and shared workstations, constitutes a sensible control.

The absence of a patch makes the standard remediation approach impractical. Security teams must evaluate compensating controls based on their specific environment architecture, without being able to rely on an official fix.

Source Limitations and Context

This analysis relies exclusively on the ZDI-26-708 advisory, the only structured primary source available. No independent confirmations or details from Microsoft are available. Specific affected Windows versions are not detailed in the advisory.

No public exploits or confirmations of in-the-wild exploitation are reported. The retroactive application of the security servicing bar — from patch confirmation to refusal — raises questions about the transparency of Microsoft's decision criteria. This is a question raised by the article, not documented in the brief.

The ZDI-26-708 case fits into a broader context of Windows vulnerabilities left unpatched. Microsoft's decision not to patch, while acknowledging the vulnerability, reflects a security servicing policy researchers are monitoring. For now, the 0-day remains documented but unresolved.

Source: Zero Day Initiative – Advisory ZDI-26-708

Information verified against cited sources and current as of publication.

Sources

• http://www.zerodayinitiative.com/advisories/ZDI-26-708/
• https://www.zerodayinitiative.com/advisories/published/