Microsoft Leaves Windows Zero-Day Unpatched: NTLM Credential Theft Without a Fix

The Zero Day Initiative published advisory ZDI-26-708 on September 16, 2026, detailing a zero-day vulnerability in Microsoft Windows that enables exfiltration of NTLM responses in the machine-account context. Microsoft, after initially confirming a fix for the September 2026 release, communicated on August 31 that the flaw did not meet the threshold for security servicing. The decision leaves enterprises with a single official mitigation: restrict interaction with the affected product.

How the Attack Works: From Malicious Proxy to Machine Credential Theft

The flaw resides in the Windows component that authenticates to HTTP proxy servers. An attacker who has already achieved low-privileged code execution on the target system modifies the proxy setting to point to a server under their control. From that point, NTLM responses are disclosed in the context of the machine account.

"By changing the proxy setting to point to a malicious server, an attacker can disclose NTLM responses in the context of the machine account" — ZDI Advisory ZDI-26-708

The mechanism requires no elevated privileges initially: the attacker operates with limited permissions and exploits the system configuration to intercept authenticated traffic. Captured NTLM responses can be reused to access resources normally protected from the user, opening the door to lateral movement within the corporate network.

The Timeline: From Confirmation to Rejection in Four Months

The vulnerability was reported to Microsoft on May 7, 2026. The vendor acknowledged receipt the same day. Initially, the flaw was slated for a fix in the September 2026 release. On August 31, 2026, Microsoft informed ZDI that the vulnerability "did not meet the bar for security servicing."

ZDI notified the vendor on September 3, 2026, of its intent to proceed with public disclosure. The advisory was published on September 16, 2026, with a 0-day classification. The CVSS score assigned by ZDI is 5.3, per entry ZDI-CAN-29849 in the published advisories list.

The CVE field in the advisory is empty. No CVE identifier has been assigned as of publication. The full CVSS vector was not provided by the source.

Why This Matters

The dossier does not specify precise Windows versions affected by the vulnerability. No evidence of in-the-wild exploitation has emerged at the time of publication. The exact rationale behind Microsoft's servicing threshold remains undisclosed: the term is not defined in the advisory, and the vendor has not provided public criteria for this classification.

The brief documents no specific remedial measures beyond the generic mitigation indicated by ZDI. The exact nature of the resources "normally protected from the user" that an attacker could access with exfiltrated credentials is not detailed in the source. The dossier does not specify whether particular trigger conditions or proxy configurations exist that would exclude a system from the vulnerability.

What Stays Unpatched: The Servicing Threshold Problem

Microsoft's decision raises a structural question about vulnerability governance in enterprise products. A defect that enables theft of machine-account credentials — a cornerstone of internal Windows domain authentication — is classified as below the intervention threshold. ZDI nonetheless assigned the flaw a CVSS 5.3, in the medium range, which does not rule out danger in enterprise contexts where HTTP proxy is configured.

The absence of an assigned CVE complicates formal tracking of the vulnerability in risk-management systems. Organizations that rely on standard databases for patch prioritization will find no unique identifier for this flaw other than the ZDI-26-708 code.

What to Do Now

According to the cited source, the only salient mitigation is:

• Restrict interaction with the vulnerable product where possible

ZDI has not published additional specific operational recommendations in the advisory. The brief documents no further technical measures such as restrictions on proxy-setting modifications, system-configuration integrity checks, or NTLM authentication monitoring. No indications emerge from the vendor or the researcher regarding potential temporary workarounds.

FAQ

What is the difference between a ZDI advisory and a standard CVE?

ZDI operates an independent vulnerability disclosure coordination program separate from the MITRE/NVD CVE system. ZDI advisories can be published without CVE assignment, as with ZDI-26-708, while retaining technical reference value and a verifiable timeline.

Why can Microsoft refuse to patch a confirmed vulnerability?

The source does not specify the vendor's internal criteria. The term "security servicing bar" is not defined in the advisory and does not appear documented in public criteria attached to the cited decision.

Does the CVSS 5.3 score make the vulnerability negligible?

The CVSS score measures technical severity via a standardized formula, not contextual enterprise risk. In enterprise environments where HTTP proxy is prevalent and machine credentials enable access to domain resources, operational impact can exceed the purely technical assessment.

Sources

• http://www.zerodayinitiative.com/advisories/ZDI-26-708/
• http://www.zerodayinitiative.com/advisories/published/

Information verified against cited sources and current as of publication.

Sources