CVE-2026-33828: Windows 10 1607 Privilege Escalation Flaw

CVE-2026-33828 Overview

CVE-2026-33828 is a trust boundary violation in Windows Attestation that enables an authorized local attacker to elevate privileges. The flaw, classified under [CWE-501], affects supported releases of Windows 10, Windows 11, and Windows Server. Microsoft published the advisory on 2026-06-09, and the issue carries a CVSS 3.1 base score of 7.8 with the vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. An attacker who already holds low-privileged code execution on the host can leverage the weakness to obtain higher integrity privileges, undermining the integrity guarantees that attestation components are intended to enforce.

Critical Impact
A local, authenticated attacker can cross the attestation trust boundary to gain full confidentiality, integrity, and availability impact on the host.

Affected Products

Microsoft Windows 10 (1607, 1809, 21H2, 22H2) — x86, x64, ARM64
Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1) — x64 and ARM64
Microsoft Windows Server 2016, 2019, 2022, and 2025

Discovery Timeline

2026-06-09 - CVE-2026-33828 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-33828

Vulnerability Analysis

The vulnerability resides in the Windows Attestation subsystem, which is responsible for measuring and reporting platform integrity to relying parties such as Device Health Attestation and conditional access controls. A trust boundary violation occurs when data or operations from a lower-trust context are accepted by a higher-trust component without proper validation. In this case, an authorized local actor can supply input that the attestation logic treats as originating from a trusted source, allowing the actor to influence a privileged code path.

Successful exploitation results in privilege elevation on the local system. Because the attestation service participates in security decisions that downstream components rely on, a violation here can have effects beyond the immediate process, including misrepresentation of platform state to remote verifiers.

Root Cause

The root cause is mapped to [CWE-501] Trust Boundary Violation. The affected code path mingles data crossing a privilege boundary without re-validating its provenance or integrity, allowing a caller with limited rights to influence operations that should be reserved for higher-trust contexts. Microsoft has not published low-level technical specifics; refer to the Microsoft Security Update Guidance for authoritative details.

Attack Vector

The attack vector is local (AV:L) and requires low privileges (PR:L) with no user interaction. The attacker must first obtain code execution on the target, for example through a phishing payload, a malicious installer, or compromise of a standard user account. From that foothold the attacker invokes the vulnerable attestation interface to escalate to a privileged context. The vulnerability is not remotely reachable across the network on its own and is therefore commonly chained with an initial access primitive.

Detection Methods for CVE-2026-33828

Indicators of Compromise

Unexpected process lineage in which a standard-user process spawns a child running as SYSTEM or another elevated identity shortly after interacting with attestation APIs.
Anomalous access to attestation-related services and components, including unusual handle opens against tpm.sys, tbs.dll, or related kernel objects from non-administrative processes.
New scheduled tasks, services, or driver loads created immediately after a local logon by a non-administrative account.

Detection Strategies

Hunt for token elevation events where the source process is medium integrity and the target is high or system integrity without a legitimate UAC prompt.
Correlate Windows Security event IDs 4672 (special privileges assigned) and 4688 (process creation) for unexpected parent-child relationships originating from standard-user sessions.
Baseline normal callers of attestation interfaces and alert on deviations, particularly user-mode binaries that have not historically interacted with these components.

Monitoring Recommendations

Forward Sysmon process creation, image load, and access events to a centralized analytics platform and retain at least 90 days of telemetry.
Monitor for installation of new local administrators or modifications to LSA secrets immediately following user-mode process activity.
Track Windows Update compliance to confirm that systems receive the June 2026 cumulative updates that remediate this issue.

How to Mitigate CVE-2026-33828

Immediate Actions Required

Apply the June 2026 Microsoft security updates referenced in the Microsoft Security Update Guidance to every affected Windows 10, Windows 11, and Windows Server build.
Prioritize patching on shared workstations, jump hosts, and administrative servers where multiple users can obtain local execution.
Audit local accounts and remove unnecessary interactive logon rights to reduce the population of users who can stage a local exploit.

Patch Information

Microsoft has released cumulative updates addressing CVE-2026-33828 for all supported Windows 10, Windows 11, and Windows Server SKUs listed above. Administrators should consult the Microsoft Security Update Guide for the exact KB articles aligned to each build and deploy through Windows Update, WSUS, Microsoft Intune, or Configuration Manager. Servers running roles that consume attestation, including Device Health Attestation and conditional access enforcement, should be patched first.

Workarounds

No vendor-supplied workaround is documented; patching is the supported remediation path.
Reduce exposure by enforcing least privilege, application control (such as Windows Defender Application Control or AppLocker), and credential hygiene to limit the ability of standard users to run untrusted code.
Where patching must be deferred, restrict interactive and remote interactive logon to administrators only on high-value hosts until updates can be applied.

bash

# Verify whether the June 2026 cumulative update is installed (PowerShell)
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10

# Force a Windows Update scan and install on a single host
UsoClient.exe StartInteractiveScan
UsoClient.exe StartInstall