Vulnerabilities
Windows MIDI Service Local Privilege Escalation (CVE‑2026‑66804) – Patch Required
A local privilege escalation flaw in the Windows MIDI Service allows attackers with low‑privileged code execution to gain SYSTEM rights. Microsoft has released a patch; defenders should apply it immediately and verify service permissions. The CVSS score is 7.8.
What Happened
Microsoft identified a flaw in the Windows MIDI Service where an incorrect permission assignment on a service resource permits local privilege escalation. An attacker who can run code with low privileges can exploit the service to obtain SYSTEM rights.
Affected Systems
- All Windows installations that include the MIDI Service (most desktop and server editions)
- CVE‑2026‑66804, CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Impact
Once exploited, the attacker can execute arbitrary code with SYSTEM privileges, enabling full control over the affected machine, data exfiltration, persistence, and lateral movement.
Mitigation
- Apply the Microsoft security update for CVE‑2026‑66804 as soon as possible.
- Verify that the MIDI Service is running only under the intended account and that its file permissions are not overly permissive.
- Restrict local code execution privileges by enforcing least‑privilege policies and monitoring for suspicious processes.
Additional Notes
Microsoft’s advisory states the vulnerability was reported on 2026‑08‑11 and publicly disclosed on 2026‑09‑08.
Related vulnerabilities
Microsoft Windows Cross Device Service Elevation of Privilege Vulnerability (CVE-2026-66804) – Immediate Defender Actions
Microsoft has acknowledged a high‑severity elevation‑of‑privilege flaw in Windows Cross Device Service (CVE‑2026‑66804). No patch is currently available, but defenders should monitor MSRC releases and harden cross‑device service access until a fix arrives.
Read briefing
CVE-2026-70104: Windows Win32k Privilege Escalation Vulnerability
A local privilege escalation flaw in the Windows Win32 kernel subsystem allows an authenticated user to gain elevated rights by dereferencing an untrusted pointer. Microsoft has issued a patch; defenders should update systems immediately and verify that the kernel component is patched.
Read briefing
CVE-2026-70255: Desktop Window Manager Local Privilege Escalation
A heap-based buffer overflow in Windows Desktop Window Manager allows a local attacker to gain elevated privileges. The flaw affects all Windows systems running DWM and can be mitigated by applying the latest security update. Defenders should verify patch status and monitor for privilege escalation events.
Read briefing
CVE-2026-70056: Windows Update Service Use-After-Free Allows Local Privilege Escalation
A use‑after‑free flaw in the Windows Update Service (wuauserv) lets an authorized local user gain SYSTEM privileges. The vulnerability affects Windows 10 and Windows 11 systems and can be mitigated by installing the latest Microsoft patch and enforcing least‑privilege controls.
Read briefing