CVSS Rating: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N - Medium (5.8) An NTLM coercion vulnerability exists on Windows nodes when the subPath supplied in a pod's volumeMounts is set to a symboli...

CVSS Rating: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N - Medium (5.8) An NTLM coercion vulnerability exists on Windows nodes when the subPath supplied in a pod's volumeMounts is set to a symboli...

Comparamos los tres protocolos de autenticación más usados en Windows: cifrado, vulnerabilidades pass-the-hash y qué conviene para un e-commerce en 2026.

Extract Windows credentials directly from VM memory snapshots and virtual disks - nikaiw/VMkatz

L'outil exploite le fait qu'une négociation NTLM non authentifiée (message Type-1 NEGOTIATE) provoque en réponse un message Type-2 CHALLENGE qui divulgue de nombreuses informations internes Active Directory avant toute transmission de credential : Noms NetBIOS et DNS de l'hôte et du domaine Nom de la forêt AD et de l'arbre Version Windows (build OS mappé vers un nom lisible) Horloge serveur et…

The video presents a security research talk by Piotr Bazydło, a principal vulnerability researcher at Watch Towel, detailing a new exploitation primitive in .NET Framework involving SOAP HTTP client proxies and WSDL imports. The vulnerability allows attackers to manipulate URLs passed to .NET’s WebRequest.Create method, enabling protocol switching from HTTP to file protocols, resulting in arbitrary file writes or NTLM relaying, with potential escalation to remote code execution (RCE). The attack surface was identified in 2024 during SharePoint reviews but gained broader relevance in July 2025 when Bazydło discovered unauthenticated WSDL import functionality in Barracuda Service Center, which dynamically generates and compiles SOAP client proxies from attacker-controlled WSDLs. Exploitation requires control over the WSDL’s service URL, SOAP method names, or input arguments, with successful RCE demonstrated in products like Barracuda, Ivanti Endpoint Manager, Umbraco 8, Microsoft PowerShell, and SQL Server Integration Services. Microsoft declined to patch the root issue, citing intended behavior, but vendors like Ivanti addressed specific instances (CVE-8.8). The research highlights risks in applications using ServiceDescriptionImporter or unvalidated WSDL inputs, with mitigation requiring protocol validation before proxy invocation.

NTLM has been a loyal companion to Windows since 1993. It helped us log in and share files, but it a...

Wine 11.15 adds ARM64EC and local NTLM support, alongside bug fixes and improvements that enhance Windows application compatibility across supported systems. The post Wine 11.15 Released with ARM64EC and Local NTLM Support appeared first on Linux Today.

ZDI disclosed ZDI-26-708, a zero-day vulnerability in Windows that exposes machine-account NTLM credentials. Microsoft initially slated a fix for September 2026 but reversed course on August 31, stating the flaw did not meet its security servicing bar, leaving organizations with only a generic mitig

Ghostlink is built around a fictional threat group running its operations on a Windows domain controller, with a message broker quietly announcing infrastructure I can’t otherwise reach. I’ll subscribe to that broker anonymously to find internal sites, then publish a tampered health check message to coerce the host into authenticating to me. Relaying that authentication gets me into a restricted file sharing site, where an unchecked path in the download endpoint gives arbitrary file read, leading to a user’s registry hive and a password database. Those credentials unlock the Gogs instance, where a symbolic link flaw in the content API lets me overwrite a Git config and get a shell on the virtual machine hosting it. I’ll crack a password hash from the Gogs database to reach a domain account, and finish by relaying coerced machine account authentication to the certificate authority to get a certificate for the domain controller and dump the domain. In Beyond Root, I’ll show why the other certificate services path never had a chance, and reverse engineer the file sharing application.

A flaw was found in gss-ntlmssp. A memory leak occurs in the NTLM target-info parser when a crafted NTLM CHALLENGE message contains duplicated string-valued AV_PAIR entries. The parser allocates memory for each string value but does not free the previous allocation when the same AV_PAIR type appears more than once, …

Get answers on timelines, Kerberos upgrades, compatibility, auditing, and next steps.

NTLM-Relaying is a common attack vector in internal networks. In this blog post, we will show that even in 2026, there are still many scenarios where NTLM-Relaying can be successfully performed, and we will provide some insights into how to mitigate these risks.