CVE-2026-42902 Overview
CVE-2026-42902 is an improper authorization vulnerability in Microsoft PowerToys. An authorized local attacker can exploit the flaw to elevate privileges on an affected Windows host. The weakness is classified under [CWE-285] Improper Authorization. Successful exploitation grants the attacker higher-integrity execution from an existing low-privilege session.
Microsoft published the advisory through its Security Update Guide. The vulnerability requires local access and low privileges, but no user interaction. It impacts confidentiality, integrity, and availability of the affected system.
Critical Impact
A local attacker with standard user privileges can escalate to a higher privilege level on Windows systems running vulnerable Microsoft PowerToys versions.
Affected Products
- Microsoft PowerToys (refer to the Microsoft Security Update Guide for the fixed version range)
Discovery Timeline
- 2026-06-09 - CVE-2026-42902 published to NVD
- 2026-06-09 - Last updated in NVD database
Technical Details for CVE-2026-42902
Vulnerability Analysis
CVE-2026-42902 is a local privilege escalation issue rooted in improper authorization checks within Microsoft PowerToys. PowerToys is a utility suite that runs with elevated components to support features such as the Run launcher, FancyZones, and system-level shortcuts. When an elevated component fails to validate the identity or privilege level of the calling process, a low-privileged user can drive privileged operations.
The vulnerability is reachable only from a local context. An attacker must already hold valid credentials on the system and execute code in an interactive session. Once exploited, the attacker can perform actions in the security context of the elevated PowerToys component.
Exploitation does not require user interaction. The scope remains unchanged, meaning the impact is contained to the vulnerable system rather than crossing a trust boundary into other components.
Root Cause
The root cause is improper authorization [CWE-285]. A privileged PowerToys component accepts requests or actions from a caller without sufficiently verifying that the caller is authorized to perform those actions. This category typically arises from missing access control list (ACL) enforcement, weak named-object permissions, or trust assumptions about inter-process communication (IPC) channels.
Attack Vector
The attack vector is local. An authorized user runs code that interacts with the vulnerable PowerToys component, supplies crafted input or invokes a privileged action, and gains execution at a higher privilege level. No network access and no phishing component are required. Microsoft has not published exploitation specifics, and no public proof-of-concept code is available at this time. Refer to the Microsoft Security Update Guide entry for CVE-2026-42902 for vendor technical details.
Detection Methods for CVE-2026-42902
Indicators of Compromise
- Unexpected child processes spawned by PowerToys binaries (for example PowerToys.exe, PowerToys.Runner.exe) running with elevated integrity levels.
- Creation or modification of files or registry keys in privileged locations following PowerToys activity by a standard user account.
- Anomalous IPC connections to PowerToys named pipes or COM endpoints from non-PowerToys processes.
Detection Strategies
- Hunt for standard user accounts launching processes that subsequently run as SYSTEM or with elevated tokens within a short time window.
- Correlate PowerToys process activity with new service installations, scheduled task creation, or token manipulation events.
- Apply behavioral rules that flag privilege escalation chains where a non-administrative parent spawns a high-integrity child.
Monitoring Recommendations
- Enable Windows Security event logging for process creation (Event ID 4688) with command line auditing.
- Forward Sysmon process and IPC telemetry to a centralized analytics platform for behavioral correlation.
- Track installed PowerToys versions across the fleet and alert on hosts running versions prior to the Microsoft-published fix.
How to Mitigate CVE-2026-42902
Immediate Actions Required
- Update Microsoft PowerToys to the version identified in the Microsoft Security Update Guide for CVE-2026-42902 on all endpoints.
- Inventory systems with PowerToys installed and prioritize patching on multi-user and shared workstations.
- Restrict standard users from installing or running unsanctioned versions of PowerToys through application control policies.
Patch Information
Microsoft has released a security update for PowerToys. Apply the fixed release referenced in the Microsoft Security Update Guide for CVE-2026-42902. Verify version after deployment to confirm remediation.
Workarounds
- Uninstall Microsoft PowerToys on systems where it is not required for business use until the patch is applied.
- Limit local interactive logon on sensitive systems to reduce the population of users who could exploit a local vulnerability.
- Apply Windows Defender Application Control (WDAC) or AppLocker rules to block execution of vulnerable PowerToys versions.
# Example: query installed PowerToys version with PowerShell
Get-AppxPackage -Name "Microsoft.PowerToys" | Select-Object Name, Version
# Example: uninstall PowerToys via winget if remediation requires removal
winget uninstall --id Microsoft.PowerToys
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
