Guillaume André

**Name of the Vulnerable Software and Affected Versions** Windows Server 2025 **Description** Improper authentication in the Windows SMB Server allows an authorized attacker to elevate privileges locally. This issue involves an NTLM reflection bypass, which can be used to obtain SYSTEM privileges on the affected system. **Recommendations** Update Windows Server 2025 to the latest patched version.

**Name of the Vulnerable Software and Affected Versions** Windows 10 Version 1607 Windows Server 2025 Windows Server 2011 **Description** Improper authentication in the Windows SMB Server allows an authorized attacker to elevate privileges locally. The issue involves a Kerberos reflection bypass, which can enable an attacker to gain SYSTEM privileges on most Windows builds. Approximately 756,600 instances were identified globally. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** (affected versions not specified) **Description** Some payload elements of the messages sent between two stations in a networking architecture are not properly checked on the receiving station, potentially allowing an attacker to execute unauthorized commands in the application. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined. **Description** The issue is being actively exploited. No further details are available about the nature of the issue or its potential impact. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Windows 10 PLUGScheduler (affected versions not specified) Description: The issue is related to an elevation of privilege vulnerability in the PLUGScheduler component of Windows operating systems. This vulnerability can be exploited to allow an attacker to gain elevated privileges on the system. The vulnerability is associated with an arbitrary file write, which can be used to execute code as SYSTEM by writing a DLL file in C:WindowsSystem32SprintCSP.dll and triggering the `SvcRebootToFlashingMode` method of the `StorSvc` service. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.