Vulnerabilities
Microsoft Windows Cross Device Service Elevation of Privilege Vulnerability (CVE-2026-66804) – Immediate Defender Actions
Microsoft has acknowledged a high‑severity elevation‑of‑privilege flaw in Windows Cross Device Service (CVE‑2026‑66804). No patch is currently available, but defenders should monitor MSRC releases and harden cross‑device service access until a fix arrives.
What happened
Microsoft has publicly acknowledged a vulnerability in the Windows Cross Device Service that allows an attacker to elevate privileges on a target system.
Impact
Exploitation could grant an attacker local administrator rights, enabling full control over the affected machine. The flaw is exploitable from a remote or local context depending on the service configuration.
What to do
Defenders should:
- Check the Microsoft Security Response Center (MSRC) for the latest update on CVE‑2026‑66804.
- Apply the forthcoming patch as soon as it is released.
- Restrict or disable the Cross Device Service on systems that do not require it.
- Enforce least‑privilege for accounts that can interact with the service.
- Enable audit logging for Cross Device Service activity and review logs for anomalous access.
Mitigation (pre‑patch)
Until a patch is available, defenders can mitigate risk by:
- Removing or disabling the Cross Device Service via Group Policy or local security policy.
- Applying network segmentation to isolate devices that use the service.
- Monitoring for known exploitation patterns such as unexpected service restarts or privilege escalation attempts.
Related vulnerabilities
Windows MIDI Service Local Privilege Escalation (CVE‑2026‑66804) – Patch Required
A local privilege escalation flaw in the Windows MIDI Service allows attackers with low‑privileged code execution to gain SYSTEM rights. Microsoft has released a patch; defenders should apply it immediately and verify service permissions. The CVSS score is 7.8.
Read briefing
Windows Device Association Broker Service Elevation of Privilege Vulnerability (CVE‑2026‑69314) – Immediate Patch Required
Microsoft has identified a local privilege escalation flaw in the Device Association Broker Service that could allow attackers to gain SYSTEM privileges. The issue affects Windows 10 and 11 and is mitigated by installing the latest cumulative update. Defenders should verify patch status and monitor for exploitation attempts.
Read briefing
Windows exFAT Elevation of Privilege Vulnerability (CVE‑2026‑69619) – Immediate Patch Required
Microsoft released a security update for CVE‑2026‑69619, an elevation‑of‑privilege flaw in the Windows exFAT file‑system driver. The vulnerability allows local attackers to gain SYSTEM rights by manipulating exFAT volumes. All Windows 10/11 and Server 2022 installations that use exFAT are affected; apply the update via Windows Update or WSUS immediately.
Read briefing
Windows ReFS Elevation of Privilege Vulnerability (CVE-2026-50441) – Immediate Patch Required
A local privilege escalation flaw in Windows ReFS allows attackers with local access to gain SYSTEM rights via a crafted volume. Microsoft has issued a cumulative update; all affected systems must be patched immediately.
Read briefing