EIP-2026-117559

This exploit leverages a WebDAV NTLM reflection vulnerability in Windows 7/8.1 to elevate privileges to Local System by tricking the Windows Defender service into authenticating to a malicious WebDAV server, which then relays the credentials to the local SMB service.