Windows Exposed: New Vulnerability Threatens User Credentials

Acros Security has announced the discovery of a vulnerability in Microsoft Windows, affecting versions from Windows 7 onward, which could be exploited to steal user credentials.

The flaw is associated with the NTLM (NT LAN Manager) authentication mechanism and was identified by the company, known for releasing unofficial “micropatches” to address software issues unacknowledged by developers.

It has been reported that viewing a specially crafted file in Windows Explorer could result in the leakage of the user’s NTLM hash, potentially allowing an attacker to capture it over a network. While specifics of the exploit remain undisclosed, there is currently no evidence of the vulnerability being actively exploited.

A detailed explanation of similar vulnerabilities and examples of their exploitation were recently provided by Morphisec. The exposure of NTLM hashes can facilitate authentication bypass or password cracking to reveal plaintext credentials.

According to Acros Security, this vulnerability affects systems ranging from Windows 7 and Server 2008 R2 to the latest versions, including Windows 11 v24H2 and Server 2022.

The flaw allows attackers to capture NTLM credentials simply by having a user view a malicious file in Windows Explorer, such as one stored in a shared folder, a USB drive, or the Downloads folder, where it may have been automatically downloaded from a malicious website.

Acros Security has reported the issue to Microsoft and plans to release a micropatch comprising a single instruction to mitigate the vulnerability. The patch will be offered free of charge until an official update is made available. Microsoft has yet to issue a statement regarding the matter.

In the past, Acros Security has alerted Microsoft to various vulnerabilities, including NTLM issues in Windows Themes and the Mark of the Web flaw in Server 2012 products.

It is worth noting that micropatches often serve as interim solutions for addressing critical vulnerabilities when official updates are unavailable. However, their application carries risks, as even minor changes require rigorous testing to prevent potential system disruptions.

This situation also raises questions about the future support of legacy Windows versions. Recently, an option to extend support for Windows 10 was introduced at $30 per year for individual users, with enterprise pricing starting at $61 per device. Windows 7, by contrast, ceased receiving updates in 2020, except for limited embedded versions.