Vulnerabilities
CVE-2026-70026: Windows Secure Kernel Use‑After‑Free Enables Local Privilege Escalation
A use‑after‑free flaw in Windows Secure Kernel allows an authenticated local user to gain SYSTEM privileges. The vulnerability affects Windows 10, 11 and Server 2016‑2022. Microsoft has issued a patch; defenders should apply updates immediately and monitor for suspicious activity.
What happened
A use‑after‑free bug in the Windows Secure Kernel module permits an attacker with local access to trigger a kernel memory corruption that elevates privileges to SYSTEM.
Impact
Once exploited, the attacker can execute arbitrary code with full system rights, install backdoors, or pivot to other machines. The flaw is local and requires the user to be logged in.
Mitigation
Microsoft released a security update for all affected Windows 10, 11 and Server 2016‑2022 releases. Apply the update through Windows Update or WSUS. Verify that the patch has been installed by checking the registry key HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Security\\CVE-2026-70026.
Recommended Actions
- Ensure all endpoints run the latest cumulative update.
- Disable any legacy features that load the Secure Kernel module if not required.
- Monitor for signs of privilege escalation such as unexpected SYSTEM processes or registry changes.
- Implement least‑privilege access controls to limit local user capabilities.
Related vulnerabilities
CVE-2026-83690: Windows Kernel Use‑After‑Free Privilege Escalation
A local use‑after‑free flaw in the Windows kernel allows an attacker with local access to gain SYSTEM privileges. Microsoft has released a patch in the latest cumulative update. Defenders should apply the update immediately and enforce least‑privilege controls.
Read briefing
Windows Storage Use-After-Free Enables Local Privilege Escalation (CVE-2026-69763)
A use‑after‑free flaw in Windows Storage allows an authorized local user to elevate privileges. The vulnerability affects Windows 10, 11, Server 2019, and 2022. Defenders should apply the latest cumulative update and enforce least‑privilege policies.
Read briefing
CVE-2026-70253: Local Privilege Escalation via Win32k Use‑After‑Free
Microsoft has identified CVE-2026-70253, a use‑after‑free flaw in the Windows Win32 kernel subsystem that allows local attackers to elevate privileges. The vulnerability requires local access and can be exploited by an authorized user to gain higher privileges. Defenders should apply the latest patches and monitor for suspicious activity.
Read briefing
Windows Hello Use-After-Free Vulnerability (CVE‑2026‑83740) Enables Local Privilege Escalation
A use‑after‑free flaw in Windows Hello allows an attacker who already has local access to gain higher privileges. The issue is present in Windows 10/11 versions prior to the latest cumulative update. Defenders should apply the latest patches, disable Hello where not needed, and monitor for anomalous privilege changes.
Read briefing