Vulnerabilities
Windows Storage Use-After-Free Enables Local Privilege Escalation (CVE-2026-69763)
A use‑after‑free flaw in Windows Storage allows an authorized local user to elevate privileges. The vulnerability affects Windows 10, 11, Server 2019, and 2022. Defenders should apply the latest cumulative update and enforce least‑privilege policies.
What happened
A use‑after‑free bug in the Windows Storage component can be triggered by an attacker with local access. The flaw allows the attacker to execute code with elevated privileges, effectively bypassing the security boundaries of the system.
Impact
Systems running Windows 10, Windows 11, Windows Server 2019, or Windows Server 2022 are vulnerable. An attacker who can write a malicious file or otherwise manipulate the storage subsystem can gain SYSTEM‑level access, enabling full control over the affected machine.
Mitigation
- Install the latest cumulative update for Windows 10/11 and Windows Server 2019/2022 (released in the May 2026 update).
- Apply the security update for the Windows Storage component (CVE‑2026‑69763) as soon as it becomes available.
- Enforce least‑privilege: restrict local administrator rights and use application whitelisting.
- Disable or limit the use of legacy storage protocols if not required.
Monitoring & Response
Watch for anomalous privilege escalation events in the Security log (Event ID 4672, 4670, 4673). Look for unexpected SYSTEM‑level processes spawned by local users.
If a compromise is suspected, isolate the host, run a full memory and disk forensic analysis, and verify that the patch is applied on all affected endpoints.
Related vulnerabilities
CVE-2026-83690: Windows Kernel Use‑After‑Free Privilege Escalation
A local use‑after‑free flaw in the Windows kernel allows an attacker with local access to gain SYSTEM privileges. Microsoft has released a patch in the latest cumulative update. Defenders should apply the update immediately and enforce least‑privilege controls.
Read briefing
Windows Hello Use-After-Free Vulnerability (CVE‑2026‑83740) Enables Local Privilege Escalation
A use‑after‑free flaw in Windows Hello allows an attacker who already has local access to gain higher privileges. The issue is present in Windows 10/11 versions prior to the latest cumulative update. Defenders should apply the latest patches, disable Hello where not needed, and monitor for anomalous privilege changes.
Read briefing
CVE-2026-72955: Windows Application Compatibility Cache Use-After-Free Privilege Escalation
A local use‑after‑free flaw in the Windows Application Compatibility Cache allows an authenticated user to gain SYSTEM privileges. The vulnerability affects all Windows systems that use the cache and can be mitigated by installing the latest security updates. Defenders should verify patch status and monitor for anomalous privilege changes.
Read briefing
CVE-2026-69840: Windows Certificates Use‑After‑Free Privilege Escalation Vulnerability
A use‑after‑free flaw in Windows Certificates can be exploited by an authenticated local user to gain elevated privileges. The issue affects all current Windows 10/11 and Windows Server releases until the latest cumulative update. Defenders should apply the patch immediately, enforce least‑privilege, and monitor certificate processing for anomalous activity.
Read briefing