If you did not receive Windows 11’s latest feature update, version 24H2, during its initial rollout, it may be time to check for updates. Microsoft has recently announced that the update is being extended to more systems, ensuring that users can take advantage of the latest enhancements.
New Vulnerability Discovered
On the same day, cybersecurity firm 0patch revealed a concerning new vulnerability within Windows that poses a significant risk to users. This zero-day flaw enables attackers to steal NTLM credentials through malware, impacting all Windows clients, including the newly released Windows 11 version 24H2, as well as various server editions. 0patch elaborated on their findings:
Our researchers discovered a vulnerability on all Windows Workstation and Server versions from Windows 7 and Server 2008 R2 to the latest Windows 11 v24H2 and Server 2022.
The vulnerability allows an attacker to obtain a user’s NTLM credentials simply by having the user view a malicious file in Windows Explorer. This could occur through various actions, such as opening a shared folder, accessing a USB drive containing the harmful file, or even viewing the Downloads folder where the file was automatically downloaded from an attacker’s webpage.
As for Windows Server 2025, which is notably absent from the list of affected versions, 0patch co-founder Mitja Kolsek explained that the team is still in the process of testing this newer release. With its recent launch in November, Windows Server 2025 includes NTLM-related enhancements, and Kolsek stated:
Windows Server 2025 has only been released this November and is still undergoing compatibility testing. We’ll start issuing 0day patches for it when testing is completed (and results satisfactory).
Microsoft is acutely aware of the security limitations associated with NTLM, or New Technology LAN Manager. The company has proactively announced the phasing out of this feature, urging users and organizations to transition to more secure and modern alternatives.
For those seeking to address this vulnerability, 0patch offers a solution. Users can visit 0patch Central, where they can register for a free account to gain access to the necessary patch.
