EUVD-2026-35529
GHSA-hr5m-mp7v-gw8f
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable NTLM exchange with no auth or UI, but requires attacker to coerce/observe authentication (AC:H); high confidentiality from leaked material, low integrity from resulting spoofing.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionNVD
Exposure of sensitive information to an unauthorized actor in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.
AnalysisAI
Information disclosure in Microsoft Windows NTLM authentication allows remote unauthenticated attackers to obtain sensitive data and conduct network spoofing attacks against affected Windows 10, Windows 11, and Windows Server installations. The flaw carries a CVSS 7.5 (high) rating due to high confidentiality impact with no privileges or user interaction required, though EPSS exploitation probability is low at 0.08% and no public exploit identified at time of analysis. Microsoft has released patches through MSRC for all affected SKUs.
Technical ContextAI
The vulnerability resides in Windows NTLM (NT LAN Manager), a legacy challenge-response authentication protocol still widely used across Windows domains for SMB, RPC, HTTP, and other authenticated services. The CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) classification indicates NTLM is leaking authentication material or identity data to network-positioned attackers, which can then be relayed or used to impersonate (spoof) legitimate principals. Per CPE data, the flaw spans Windows 10 1607 (x86/x64), Windows 11 22H2 (x64/ARM64), Windows Server 2004, Server 2012/2012 R2, Server 2016, and Server 2022 - indicating the affected code path is in shared core NTLM components rather than a single SKU.
RemediationAI
Apply the Microsoft security updates that bring each SKU to at or above the fixed builds listed in the MSRC advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50508): 10.0.14393.9234 for Windows 10 1607 / Server 2016, 10.0.22631.7219 for Windows 11 22H2, 10.0.19045.7417 for Windows Server 2004, 10.0.20348.5256 for Server 2022, 6.2.9200.26132 for Server 2012, and 6.3.9600.23228 for Server 2012 R2 - patch via WSUS, Intune, or Windows Update on the next Patch Tuesday cycle. Until patched, reduce NTLM exposure by enabling SMB signing and LDAP signing/channel binding to defeat relay, enforcing Extended Protection for Authentication (EPA) on IIS/Exchange/AD CS web endpoints, and restricting outbound NTLM with the 'Network security: Restrict NTLM' Group Policy where feasible - be aware that disabling NTLM outright can break legacy applications and non-domain-joined clients, so audit with NTLM auditing GPOs first. Block SMB (TCP/445) and other NTLM-bearing protocols at the network perimeter to prevent untrusted hosts from initiating authentication flows.
More in Windows 10 1607
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Elevation of privilege in the Windows Win32k kernel-mode driver allows a local, low-privileged attacker to escalate to S
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today