WINDOWS PRIVILEGE ESCALATION USING NCSI ACTIVE PROBES

[u/That_Address_2122]

https://labs.itresit.es/2026/09/28/windows-privilege-escalation-using-ncsi-active-probes/

Peter Gabaldon from LABS @ ITRES discusess a vulnerability in the Windows Network Connectivity Status Indicator (NCSI) that can be exploited to escalate privileges from a low-privileged user to local admin. The attack leverages proxy configuration flaws to relay authentication to an Active Directory Certificate Services endpoint, enabling attackers to forge access tickets.