Vulnerabilities
CVE-2026-70056: Windows Update Service Use-After-Free Allows Local Privilege Escalation
A use‑after‑free flaw in the Windows Update Service (wuauserv) lets an authorized local user gain SYSTEM privileges. The vulnerability affects Windows 10 and Windows 11 systems and can be mitigated by installing the latest Microsoft patch and enforcing least‑privilege controls.
What happened
The Windows Update Service (wuauserv) contains a use‑after‑free bug that can be triggered by an authorized local user. The flaw allows the attacker to execute code with SYSTEM privileges, effectively elevating local privileges.
Impact
Systems running Windows 10 or Windows 11 are vulnerable. An attacker who can authenticate to the machine can abuse the flaw to gain full control, bypassing standard privilege boundaries.
What to do
Apply the latest security update from Microsoft (CVE‑2026‑70056). Until the patch is installed, restrict local administrative rights and monitor for suspicious privilege escalation. Enable Windows Defender Exploit Guard and use AppLocker or similar controls to block unauthorized binaries.
Remediation Steps
- Install the Windows 10/11 update that addresses CVE‑2026‑70056.
- Verify that the Windows Update Service is running with the correct configuration.
- Enforce least privilege; remove unnecessary local admin accounts.
- Enable Exploit Guard and monitor event logs for privilege escalation attempts.
Related vulnerabilities
CVE-2026-83690: Windows Kernel Use‑After‑Free Privilege Escalation
A local use‑after‑free flaw in the Windows kernel allows an attacker with local access to gain SYSTEM privileges. Microsoft has released a patch in the latest cumulative update. Defenders should apply the update immediately and enforce least‑privilege controls.
Read briefing
Windows Storage Use-After-Free Enables Local Privilege Escalation (CVE-2026-69763)
A use‑after‑free flaw in Windows Storage allows an authorized local user to elevate privileges. The vulnerability affects Windows 10, 11, Server 2019, and 2022. Defenders should apply the latest cumulative update and enforce least‑privilege policies.
Read briefing
CVE-2026-72934: Local Privilege Escalation via Windows Program Compatibility Assistant Service Use‑After‑Free
Microsoft identified a use‑after‑free flaw in the Windows Program Compatibility Assistant Service that allows a local attacker with user‑level access to gain SYSTEM privileges. The vulnerability exists in all current Windows 10 and 11 builds that include PCAS. Administrators should apply the latest cumulative update, disable the service where possible, and monitor for privilege‑escalation indicators.
Read briefing
CVE-2026-72955: Windows Application Compatibility Cache Use-After-Free Privilege Escalation
A local use‑after‑free flaw in the Windows Application Compatibility Cache allows an authenticated user to gain SYSTEM privileges. The vulnerability affects all Windows systems that use the cache and can be mitigated by installing the latest security updates. Defenders should verify patch status and monitor for anomalous privilege changes.
Read briefing