CVE-2025-59201: Windows Network Connection Status Indicator (NCSI) Elevation of Privilege via Registry Symbolic Link Abuse

CVE-2025-59201 (TL-2026-2480) is a high-severity software vulnerability scored CVSS 7.8, first published 2026-09-13. It has no confirmed attribution, affects Microsoft Windows 10, references 1 CVE (CVE-2025-59201), maps to 6 MITRE ATT&CK techniques (T1053.005, T1059.003, T1106), and is covered by 9 detection rules and 16 indicators of compromise.

Key facts for TL-2026-2480

Threat ID
TL-2026-2480
Severity
HIGH
CVSS
7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Status
PATCHED
Category
VULNERABILITY
First published
2026-09-13
Last reviewed
2026-09-13
Attribution confidence
LOW
Motivation
UNKNOWN
Detection rules
9
Indicators of compromise
16

Malware and tooling in CVE-2025-59201

Malware and tooling: Windows10, BinDiff, EtwExplorer, System Informer, Winbindex

A weak DACL on the NlaSvc\Parameters registry key let a local low-privileged Windows attacker chain the Customer Experience Improvement Program "Consolidator" scheduled task, registry symbolic links, and an ETW-triggered write in ncsi.dll to force NETWORK SERVICE to write attacker-controlled registry values. Microsoft fixed the path-traversal and tightened the key's ACL in KB5066835 (October 14, 2025); no public exploit code or in-the-wild exploitation has been reported.

How CVE-2025-59201 works

CVE-2025-59201 is a local elevation-of-privilege vulnerability (CWE-284, Improper Access Control) in the Network Connection Status Indicator (NCSI) component of the Windows Network List Service (netprofm, hosted in ncsi.dll). Prior to the October 2025 patch, the registry key HKLM\SYSTEM\CurrentControlSet\Services\NlaSvc\Parameters granted the INTERACTIVE identity the "Create Subkeys" permission. Security researcher itm4n (Clément Labro) published a full technical reconstruction of the exploit chain reported to Microsoft by researcher Tianlin Zhang (@t0zhang), built by binary-diffing the October 2025 patch against the prior ncsi.dll with BinDiff (pulling historical builds from Winbindex), and tracing behavior with Process Monitor, EtwExplorer, and System Informer.

The exploitation chain works in three stages. First, the attacker abuses the built-in "Microsoft\Windows\Customer Experience Improvement Program\Consolidator" scheduled task (which runs as SYSTEM via wsqmcons.exe and is user-triggerable via `schtasks /run`) to recursively delete registry keys the attacker previously staged under HKLM\SOFTWARE\Microsoft\SQMClient\CommonUploader\Paths; this SYSTEM-context delete is repurposed — by planting a registry symbolic link (a SymbolicLinkValue value on a staged "to_delete" subkey) — to also remove the NlaSvc\Parameters\Internet subkey, which the attacker then recreates with a permissive, self-controlled DACL. Second, the attacker creates a registry symbolic link (via `RegCreateKeyExW` with the `REG_OPTION_CREATE_LINK` flag) named ManualProxies under the recreated Internet key, redirecting it to an arbitrary target registry location. Third, the attacker calls `InternetSetOptionA/W` with `INTERNET_OPTION_SETTINGS_CHANGED` and `INTERNET_OPTION_REFRESH` (or directly fires the event with `EventRegister`/`EventWrite`/`EventUnregister`), which raises the Microsoft-Windows-WinINet-Config ETW provider (GUID `5402e5ea-1bdd-4390-82be-e108f1e634f5`); ncsi.dll's `EtwListener::ProcessEvent` handler consumes this event and calls `StoreNcsiIEProxyString`, which performs a privileged `RegSetValueExW` write in the NETWORK SERVICE service context — but because ManualProxies is now a symbolic link, the write lands at the attacker's redirected registry location instead of the intended key.

Microsoft's own advisory characterizes the vulnerability as allowing an authorized (i.e., already locally authenticated, low-privileged) attacker to elevate privileges locally; itm4n notes the researcher's proof of concept demonstrates the ability to write an arbitrary value (e.g., a DLL path such as `\..\..\..\..\C:\foo.dll` written to the `(Default)` value of `HKLM\SYSTEM\CurrentControlSet\Services\TPM\WMI`) to an arbitrary registry location rather than achieving direct code execution as SYSTEM or NETWORK SERVICE outright — the PoC exists and works but was not publicly released, only the methodology and API-level walkthrough were published. A March 14, 2026 update to the article explicitly clarifies the PoC "was never meant to result in true code execution as NT AUTHORITY\SYSTEM, or even NT AUTHORITY\NETWORK SERVICE"; the path-traversal write was only meant to showcase the primitive in case some privileged service later loads a DLL from that writable key. itm4n separately notes that once an attacker holds a NETWORK SERVICE-context write primitive, escalation to full SYSTEM is a solved problem via the shared-logon-session token-impersonation technique James Forshaw published in 2020 ("Sharing a Logon Session a Little Too Much": NETWORK SERVICE loopback-authenticates over a named pipe to obtain and impersonate RPCSS's token, the first token created in that logon session, which can be leveraged to reopen RPCSS with SYSTEM-level access).

The underlying Consolidator-scheduled-task registry-delete primitive is not unique to NCSI: it is the generic root cause of the separate, related CVE-2025-59512 (CEIP Elevation of Privilege), which Microsoft patched on November 11, 2025 and which 0patch subsequently micropatched (March 30, 2026) for 13 legacy/EOL Windows builds — 0patch's write-up explicitly credits itm4n's CVE-2025-59201 reverse-engineering as what let them reproduce and patch the companion flaw. Microsoft's fix for CVE-2025-59201, shipped in KB5066835 (October 14, 2025) and the corresponding October 2025 cumulative updates for all other supported Windows 10/11/Server branches, adds a `ContainsRelativePathDoubleDot`-style path-traversal validation to `StoreNcsiIEProxyString` and removes the "Create Subkeys" ACE from INTERACTIVE on the affected Services\Parameters registry keys, closing both the symlink-planting and the redirect-write primitives. No CISA KEV listing or in-the-wild exploitation has been reported, and EPSS scoring places 30-day exploitation probability at 0.40% (32.3rd percentile).

MITRE ATT&CK techniques used in TL-2026-2480

Execution

T1053.005 Scheduled Task/Job: Scheduled Task; T1059.003 Command and Scripting Interpreter: Windows Command Shell; T1106 Native API

Privilege Escalation

T1053.005 Scheduled Task/Job: Scheduled Task; T1134.001 Access Token Manipulation: Token Impersonation/Theft

defense-impairment

T1112 Modify Registry

Defense Evasion

T1134.001 Access Token Manipulation: Token Impersonation/Theft; T1574.011 Hijack Execution Flow: Services Registry Permissions Weakness

stealth

T1574.011 Hijack Execution Flow: Services Registry Permissions Weakness

Affected products and versions in CVE-2025-59201

  • Microsoft — Windows 10
    Vulnerable versions: 1507: 10.0.10240.0 - 10.0.10240.21161; 1607: 10.0.14393.0 - 10.0.14393.8519; 1809: 10.0.17763.0 - 10.0.17763.7919; 21H2: 10.0.19044.0 - 10.0.19044.6456; 22H2: 10.0.19045.0 - 10.0.19045.6456
    Fixed in: 1507: KB5066837 (10.0.10240.21161); 1607/1809/21H2/22H2: October 14, 2025 cumulative update
  • Microsoft — Windows 11
    Vulnerable versions: 22H2: 10.0.22621.0 - 10.0.22621.6060; 23H2: 10.0.22631.0 - 10.0.22631.6060; 24H2: 10.0.26100.0 - 10.0.26100.6899; 25H2: 10.0.26200.0 - 10.0.26200.6899
    Fixed in: 24H2/25H2: KB5066835 (10.0.26100.6899 / 10.0.26200.6899); 22H2/23H2: October 14, 2025 cumulative update
  • Microsoft — Windows Server
    Vulnerable versions: 2008 SP2: 6.0.6003.0 - 6.0.6003.23571; 2008 R2 SP1: 6.1.7601.0 - 6.1.7601.27974; 2012: 6.2.9200.0 - 6.2.9200.25722; 2012 R2: 6.3.9600.0 - 6.3.9600.22824; 2016: 10.0.14393.0 - 10.0.14393.8519; 2019: 10.0.17763.0 - 10.0.17763.7919; 2022: 10.0.20348.0 - 10.0.20348.4294; 2025: 10.0.26100.0 - 10.0.26100.6899
    Fixed in: respective October 14, 2025 (October 2025 Patch Tuesday) security update per product

Remediation for CVE-2025-59201

Patches

  • KB5066835 — Windows 11 24H2/25H2, OS builds 26100.6899 / 26200.6899, released 2025-10-14
  • Matching October 14, 2025 cumulative updates for Windows 10 1507 (KB5066837, build 10.0.10240.21161), 1607, 1809, 21H2, 22H2, Windows 11 22H2/23H2, and Windows Server 2008–2025
  • November 11, 2025 cumulative updates addressing the related CVE-2025-59512 (CEIP Consolidator arbitrary registry-delete)

Immediate actions

  • Apply KB5066835 (Windows 11 24H2/25H2) or the matching October 14, 2025 cumulative update for every other supported Windows 10, Windows 11, and Windows Server branch
  • Also confirm the November 11, 2025 patch for the related CVE-2025-59512 (CEIP Consolidator arbitrary registry-delete) is deployed, since both flaws share the same Consolidator scheduled-task abuse primitive
  • Verify the ACL on HKLM\SYSTEM\CurrentControlSet\Services\NlaSvc\Parameters no longer grants the INTERACTIVE identity the Create Subkeys permission after patching
  • Audit Task Scheduler logs for unexpected manual invocation (schtasks /run) of \Microsoft\Windows\Customer Experience Improvement Program\Consolidator by non-SYSTEM-initiated processes

Workarounds

  • No workaround exists short of patching; the fix requires both the code-level path-traversal check in StoreNcsiIEProxyString and the tightened DACL on the NlaSvc\Parameters key

Longer-term hardening

  • Deploy registry-integrity / EDR monitoring on Services\*\Parameters keys that back SYSTEM or NETWORK SERVICE service processes, alerting on subkey creation by non-privileged tokens
  • Restrict local interactive and RDP logon rights for low-privilege accounts on hosts where a local EoP chain carries outsized blast radius (jump boxes, terminal servers, shared workstations)
  • Track future Patch Tuesday advisories for related NLA/NCSI/WinINet/CEIP registry-permission issues and confirm patch compliance via WSUS/Intune/ConfigMgr reporting rather than assuming deployment
  • For legacy/EOL Windows builds no longer receiving vendor patches, evaluate third-party micropatching (e.g., 0patch) for the Consolidator scheduled-task family of issues

CVEs associated with CVE-2025-59201

CVE-2025-59201

Weaknesses (CWE) in CVE-2025-59201

CWE-284

Timeline of CVE-2025-59201

  • CVE-2025-59201 is publicly assigned and published via the Microsoft Security Response Center advisory with CVSS 3.1 base score 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), crediting researcher Tianlin Zhang (@t0zhang) for the report.
  • Microsoft ships KB5066835 (Windows 11 24H2/25H2, builds 26100.6899/26200.6899) plus the matching October 2025 cumulative updates for all other supported Windows 10/11/Server branches, adding path-traversal validation to StoreNcsiIEProxyString and tightening the NlaSvc\Parameters registry ACL.
  • Trade press (WindowsForum) reports on the October 2025 Patch Tuesday fix for the NCSI local privilege escalation issue.
  • Microsoft patches the related CVE-2025-59512 (Customer Experience Improvement Program arbitrary registry-key delete via the same Consolidator scheduled task), the generic delete primitive that CVE-2025-59201 repurposes for its NCSI-specific redirected write.
  • The Threadlinqs Intelligence HUNT phase ingests itm4n's write-up from the itm4n's blog RSS feed and opens threat skeleton TL-2026-2480.
  • itm4n (Clément Labro) publishes a full technical reconstruction of the exploit chain — patch binary diffing with BinDiff against historical builds pulled from Winbindex, ETW provider enumeration with EtwExplorer, and Process Monitor/System Informer tracing — reproducing the registry-symlink and scheduled-task-abuse mechanics without releasing exploit code.
  • itm4n updates the CVE-2025-59201 write-up to explicitly clarify the published proof-of-concept was never intended to demonstrate true code execution as SYSTEM or NETWORK SERVICE, only to showcase the arbitrary registry-write primitive.
  • 0patch publishes micropatches for the related CVE-2025-59512 covering 13 legacy/EOL Windows versions/editions, explicitly crediting itm4n's CVE-2025-59201 reverse-engineering work for helping reproduce and patch the companion Consolidator-task flaw.
  • The NVD CVE-2025-59201 record is last modified, refreshing metadata against the published advisory.

Sources cited for CVE-2025-59201

More in vulnerability

Detection coverage for TL-2026-2480

As of 2026-09-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2480 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats