Executive brief
Windows Kernel contains a missing authorization check that allows an already-authenticated attacker to escalate privileges on a local machine. An attacker with basic user access could exploit this flaw to gain system-level control, compromising the entire machine and enabling unauthorized access to sensitive data or disruptive operations.
Technical details
This vulnerability is a privilege escalation flaw in Windows Kernel resulting from missing authorization checks. The attack requires local access and an authenticated user account; remote exploitation is not possible. An attacker with standard user-level credentials can leverage this missing authorization control to elevate to SYSTEM or administrator privileges. The CVSS v3.1 score of 7.8 reflects the high impact on confidentiality and integrity once privileges are escalated. Microsoft has released a security update to address this issue.
Affected products
- Microsoft Windows Kernel
Timeline
- 2026-09-08: disclosed