Microsoft NTLM Zero-Day to Remain Unpatched Until April

Microsoft and ACROS Security reported a Windows NTLM credential-disclosure zero-day affecting all supported Windows Workstation and Server versions; an attacker can obtain a user's NTLM hashes by getting them to view a malicious file in Explorer. Microsoft classed the issue as "Important," plans a fix in April, and updated guidance to enable Extended Protection for Authentication (EPA) to mitigate NTLM-relay attacks, while ACROS has withheld full disclosure until a patch and suggested 0patch micropatches as an interim option.