# CVE-2025-59201: Windows Network Connection Status Indicator (NCSI) Elevation of Privilege via Registry Symbolic Link Abuse

> A weak DACL on the NlaSvc\Parameters registry key let a local low-privileged Windows attacker chain the Customer Experience Improvement Program "Consolidator" scheduled task, registry symbolic links, and an ETW-triggered write in ncsi.dll to force NETWORK SERVICE to write attacker-controlled registry values. Microsoft fixed the path-traversal and tightened the key's ACL in KB5066835 (October 14, 2025); no public exploit code or in-the-wild exploitation has been reported.

- **Published:** 2026-09-13T00:00:00Z
- **Last reviewed:** 2026-09-13T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2480
- **ID:** TL-2026-2480
- **Severity:** HIGH (CVSS 7.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-59201, CVE-2025-59512

## Description

CVE-2025-59201 is a local elevation-of-privilege vulnerability (CWE-284, Improper Access Control) in the Network Connection Status Indicator (NCSI) component of the Windows Network List Service (netprofm, hosted in ncsi.dll). Prior to the October 2025 patch, the registry key HKLM\SYSTEM\CurrentControlSet\Services\NlaSvc\Parameters granted the INTERACTIVE identity the "Create Subkeys" permission. Security researcher itm4n (Clément Labro) published a full technical reconstruction of the exploit chain reported to Microsoft by researcher Tianlin Zhang (@t0zhang), built by binary-diffing the October 2025 patch against the prior ncsi.dll with BinDiff (pulling historical builds from Winbindex), and tracing behavior with Process Monitor, EtwExplorer, and System Informer.

The exploitation chain works in three stages. First, the attacker abuses the built-in "Microsoft\Windows\Customer Experience Improvement Program\Consolidator" scheduled task (which runs as SYSTEM via wsqmcons.exe and is user-triggerable via `schtasks /run`) to recursively delete registry keys the attacker previously staged under HKLM\SOFTWARE\Microsoft\SQMClient\CommonUploader\Paths; this SYSTEM-context delete is repurposed — by planting a registry symbolic link (a SymbolicLinkValue value on a staged "to_delete" subkey) — to also remove the NlaSvc\Parameters\Internet subkey, which the attacker then recreates with a permissive, self-controlled DACL. Second, the attacker creates a registry symbolic link (via `RegCreateKeyExW` with the `REG_OPTION_CREATE_LINK` flag) named ManualProxies under the recreated Internet key, redirecting it to an arbitrary target registry location. Third, the attacker calls `InternetSetOptionA/W` with `INTERNET_OPTION_SETTINGS_CHANGED` and `INTERNET_OPTION_REFRESH` (or directly fires the event with `EventRegister`/`EventWrite`/`EventUnregister`), which raises the Microsoft-Windows-WinINet-Config ETW provider (GUID `5402e5ea-1bdd-4390-82be-e108f1e634f5`); ncsi.dll's `EtwListener::ProcessEvent` handler consumes this event and calls `StoreNcsiIEProxyString`, which performs a privileged `RegSetValueExW` write in the NETWORK SERVICE service context — but because ManualProxies is now a symbolic link, the write lands at the attacker's redirected registry location instead of the intended key.

Microsoft's own advisory characterizes the vulnerability as allowing an authorized (i.e., already locally authenticated, low-privileged) attacker to elevate privileges locally; itm4n notes the researcher's proof of concept demonstrates the ability to write an arbitrary value (e.g., a DLL path such as `\..\..\..\..\C:\foo.dll` written to the `(Default)` value of `HKLM\SYSTEM\CurrentControlSet\Services\TPM\WMI`) to an arbitrary registry location rather than achieving direct code execution as SYSTEM or NETWORK SERVICE outright — the PoC exists and works but was not publicly released, only the methodology and API-level walkthrough were published. A March 14, 2026 update to the article explicitly clarifies the PoC "was never meant to result in true code execution as NT AUTHORITY\SYSTEM, or even NT AUTHORITY\NETWORK SERVICE"; the path-traversal write was only meant to showcase the primitive in case some privileged service later loads a DLL from that writable key. itm4n separately notes that once an attacker holds a NETWORK SERVICE-context write primitive, escalation to full SYSTEM is a solved problem via the shared-logon-session token-impersonation technique James Forshaw published in 2020 ("Sharing a Logon Session a Little Too Much": NETWORK SERVICE loopback-authenticates over a named pipe to obtain and impersonate RPCSS's token, the first token created in that logon session, which can be leveraged to reopen RPCSS with SYSTEM-level access).

The underlying Consolidator-scheduled-task registry-delete primitive is not unique to NCSI: it is the generic root cause of the separate, related CVE-2025-59512 (CEIP Elevation of Privilege), which Microsoft patched on November 11, 2025 and which 0patch subsequently micropatched (March 30, 2026) for 13 legacy/EOL Windows builds — 0patch's write-up explicitly credits itm4n's CVE-2025-59201 reverse-engineering as what let them reproduce and patch the companion flaw. Microsoft's fix for CVE-2025-59201, shipped in KB5066835 (October 14, 2025) and the corresponding October 2025 cumulative updates for all other supported Windows 10/11/Server branches, adds a `ContainsRelativePathDoubleDot`-style path-traversal validation to `StoreNcsiIEProxyString` and removes the "Create Subkeys" ACE from INTERACTIVE on the affected Services\Parameters registry keys, closing both the symlink-planting and the redirect-write primitives. No CISA KEV listing or in-the-wild exploitation has been reported, and EPSS scoring places 30-day exploitation probability at 0.40% (32.3rd percentile).

## MITRE ATT&CK

- T1059.003 Command and Scripting Interpreter: Windows Command Shell
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1106 Native API
- T1574.011 Hijack Execution Flow: Services Registry Permissions Weakness
- T1574.011 Hijack Execution Flow: Services Registry Permissions Weakness
- T1574.011 Hijack Execution Flow: Services Registry Permissions Weakness
- T1112 Modify Registry
- T1134.001 Access Token Manipulation: Token Impersonation/Theft
- T1134.001 Access Token Manipulation: Token Impersonation/Theft

## Sources

- [CVE-2025-59201 - Network Connection Status Indicator (NCSI) EoP](https://itm4n.github.io/cve-2025-59201-ncsi-eop/)
- [CVE-2025-59201 Security Update Guide](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59201)
- [October 14, 2025—KB5066835 (OS Builds 26200.6899 and 26100.6899)](https://support.microsoft.com/en-us/servicing/os/windows-11/2025/10/october-14-2025-kb5066835-os-builds-26200-6899-and-26100-6899)
- [NVD - CVE-2025-59201](https://nvd.nist.gov/vuln/detail/CVE-2025-59201)
- [CVE-2025-59201 - Vulnerability Details](https://app.opencve.io/cve/CVE-2025-59201)
- [CVE-2025-59201: Windows Improper Access Control](https://www.strix.ai/cve/CVE-2025-59201)
- [Microsoft Patch Fixes CVE-2025-59201 NCSI Local Privilege Escalation](https://windowsforum.com/threads/microsoft-patch-fixes-cve-2025-59201-ncsi-local-privilege-escalation.384584/)
- [CVE-2025-59512 - Customer Experience Improvement Program (CEIP) Elevation of Privilege Vulnerability](https://msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2025-59512)
- [CVE-2025-59512: Windows 10 1607 Privilege Escalation Flaw](https://www.sentinelone.com/vulnerability-database/cve-2025-59512/)
- [Micropatches released for Arbitrary Registry Key Delete As Local System With Consolidator Scheduled Task (CVE-2025-59512)](https://0patch.com/blog/micropatches-released-for-arbitrary-registry-key-delete-as-local-system-with-cons)
- [Sharing a Logon Session a Little Too Much](https://www.tiraniddo.dev/2020/04/sharing-logon-session-little-too-much.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2480