James Forshaw

A flaw exists in the Winlogon login program of Windows operating systems related to incorrect handling of symbolic links during file access. Exploitation of this issue could allow an attacker to elevate their privileges. The issue involves improper link resolution before file access ('link following') in Winlogon, potentially allowing an authorized attacker to gain elevated privileges locally. Reports indicate a low-privilege attacker can achieve SYSTEM-level access without user interaction. This is considered a significant post-exploitation pathway.

The issue concerns the insufficient protection of sensitive data within the Windows Accessibility Infrastructure (ATBroker.exe). Successful exploitation could allow an unauthorized actor to disclose information locally. The vulnerability allows attackers to obtain sensitive information and affect the system.

An improper permission assignment within the Windows Accessibility Infrastructure (ATBroker.exe) allows an authorized attacker to elevate privileges locally. The issue stems from insecure registry permissions, enabling a local user to overwrite values and execute arbitrary code with SYSTEM privileges. This flaw, dubbed "RegPwn" (CVE-2026-24291), targets accessibility features like the On-Screen Keyboard and Narrator. The vulnerability was exploited in Red Team engagements since January 2025. Exploitation involves manipulating a writable registry key associated with accessibility features, swapping it with a symbolic link pointing to a restricted system registry location. This allows the attacker to write arbitrary values to protected areas, ultimately gaining SYSTEM-level access. The vulnerability affects Windows 10, Windows 11, and Windows Server 2016/2019/2022.

Improper access control in the Windows SMB Client, specifically within the `mrxsmb.sys` driver, allows an authorized or unauthenticated remote attacker to elevate privileges to the `NT AUTHORITYSYSTEM` level. The issue stems from flaws in access restriction during authentication relay. Attackers can use authentication coercion techniques, such as forcing a request to a UNC path, to compel a Windows host to connect to a malicious system via SMB. By manipulating `CREDENTIAL TARGET INFORMATIONW` and forcing the use of Kerberos over NTLM, an attacker can capture a Kerberos ticket from a computer account (`DOMAINMACHINE$`) and relay it back to the same host. This process results in a session with full system control over the target machine via standard RPC/SMB services.

The issue is related to an elevation-of-privilege vulnerability in the Windows Kernel, which is associated with insufficient access control. This vulnerability can be exploited by an attacker to elevate their privileges. The vulnerability is related to the File History Service and involves the `fhsvc.dll` and `CManagerThread::QueueBackupForLoggedOnUser`. It allows local Windows users to escalate privileges. The vulnerability was discovered by an independent researcher with SSD Secure Disclosure.

The issue concerns incorrect default permissions in some memory controller configurations for Intel(R) Xeon(R) Processors when using Intel(R) Software Guard Extensions. This may allow a privileged user to potentially enable escalation of privilege via local access. The vulnerability is related to Intel Microcode and is associated with default permission settings. Exploitation of the vulnerability could allow an attacker to access confidential data, compromise data integrity, and cause a denial of service.

The issue is related to an elevation-of-privilege vulnerability in the Windows HTTP.sys driver, which is associated with insufficient access restrictions. Exploitation of this issue may allow an attacker to elevate their privileges.

The issue is related to errors in privilege management in the implementation of the Kerberos protocol in Windows operating systems. It allows a remote attacker to elevate their privileges.

The issue is related to errors in privilege management in the implementation of the Kerberos protocol in Windows operating systems. It allows a remote attacker to elevate their privileges. There is no information about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

The issue is related to a buffer overflow in memory, which can be exploited to elevate privileges.

The issue is related to errors in security settings, which can allow an attacker to bypass security restrictions.

The issue is related to a lack of protection for service data in Windows Defender, which could allow an attacker to gain unauthorized access to a device. It enables attackers to obtain sensitive information and affect the system.

The issue is related to insufficient access restrictions in Windows Defender, which is part of the Windows operating system. This can allow an attacker to elevate their privileges. There is no information provided about the estimated number of potentially affected devices or real-world incidents where this issue was exploited.

The issue is related to insufficient access control in Windows Defender, which is part of the Windows operating system. It allows an attacker to elevate their privileges.

The issue is related to a security feature bypass in Windows Defender, allowing attackers to bypass the Kerberos authentication procedure. This could potentially enable an attacker to affect the system. The vulnerability is associated with errors in security settings.

The issue is related to a lack of protection for sensitive data in Windows Defender, which could allow an attacker to obtain unauthorized access to protected information. This could potentially lead to the disclosure of sensitive information.

The issue is related to an elevation-of-privilege vulnerability in Windows Credential Guard, which is associated with insecure privilege management. This vulnerability can be exploited to allow an attacker to elevate their privileges.

The issue is related to the implementation of the Kerberos protocol in Windows operating systems, specifically due to insufficient access restrictions. This allows a remote attacker to potentially elevate their privileges. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world incidents where this issue was exploited.

The issue is related to insufficient access control in the Local Security Authority Subsystem Service (LSASS) of Windows operating systems. It allows an attacker to elevate their privileges. The vulnerability can be exploited to affect the system. There is an estimated elevation-of-privilege vulnerability that allows attackers to impact the system.

The issue is related to the implementation of the Kerberos protocol in Windows, specifically due to insufficient input validation. This allows a remote attacker to potentially execute arbitrary code, affecting the system. The vulnerability can be exploited by a remote attacker, leading to a denial of service.