Hashcat 7.1.2 Has Three Unpatched Vulnerabilities That Can Compromise Your Machine

Sun, 03 May 2026 10:47:49 +0200

Hashcat v7.1.2 has three unpatched vulnerabilities, all rated 9.8 out of 10. The tool that security professionals use to crack passwords can be used to crack the machine running it. The CVEs landed on May 1, 2026. There is still no patch.

Hashcat is the standard tool for recovering passwords from hashes. A hash is what a password looks like after a one-way scrambling algorithm runs over it. When a database leaks, the passwords do not come out as readable text. They come out as hashes, long strings of letters and numbers that look like gibberish. Hashcat works backwards. It takes guesses, runs the same algorithm over them, and checks whether the result matches a hash in the list. A single RTX 4090 can run through nearly 300 billion of those checks every second for the NTLM hash type used across Windows corporate networks. The tool has won the KoreLogic “Crack Me If You Can” 562901440119f978aa2b3ed1c1b6439a competition at DEF CON multiple times. Turns out, you can.

Cracking Windows Domain Admin Passwords Just Got Simple

Tue, 20 Jan 2026 15:09:59 +0100

Cracking Windows domain admin passwords just got simple. A massive set of rainbow tables just went public, a $600 laptop is enough, and it takes 12 hours max. This flaw has existed since 1999. Microsoft ignored it for 25 years. So Google decided to force the conversation. 🔓

The flaw is in NTLMv1. That’s an authentication protocol from 1993. When a Windows machine logs in over a network, it sends an encrypted response based on the user’s password. The problem? That encryption uses 56-bit DES. Cryptographers declared that dead decades ago.

Password-Cracking on HackingPassion.com : root@HackingPassion.com-[~]

Hashcat 7.1.2 Has Three Unpatched Vulnerabilities That Can Compromise Your Machine

Cracking Windows Domain Admin Passwords Just Got Simple