CVE-2026-42976: Windows 10 1607 Privilege Escalation Flaw

CVE-2026-42976 Overview

CVE-2026-42976 is a privilege escalation vulnerability in the Windows Remote Procedure Call (RPC) API. The flaw stems from missing authentication for a critical function [CWE-306], allowing an authorized local attacker to elevate privileges on affected Microsoft Windows systems. Microsoft published the advisory on 2026-08-11, covering client releases from Windows 10 1607 through Windows 11 26H1 and server releases from Windows Server 2012 through Windows Server 2025. Successful exploitation results in high impact to confidentiality, integrity, and availability, giving an attacker the ability to execute code or perform actions at an elevated privilege level.

Critical Impact
An authenticated local user can invoke an unauthenticated RPC function to escalate to SYSTEM-level privileges across most supported Windows client and server versions.

Affected Products

Microsoft Windows 10 (1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (24H2, 25H2, 26H1)
Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025

Discovery Timeline

2026-08-11 - CVE-2026-42976 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-42976

Vulnerability Analysis

The vulnerability resides in the Windows RPC API, a core interprocess communication mechanism used by system services and applications on all supported Windows versions. A critical RPC function fails to enforce authentication on incoming requests. As a result, a local attacker who already holds low-privileged access to the system can invoke this function without providing the credentials or context normally required for privileged operations. Successful invocation grants the attacker the ability to run code or manipulate state within a higher-privilege security context, typically SYSTEM.

Root Cause

The root cause is classified as CWE-306: Missing Authentication for Critical Function. A privileged RPC interface exposed by Windows does not validate that the caller is authorized to invoke the affected procedure. The interface trusts the caller by virtue of reachability rather than identity, breaking the standard RPC security model where sensitive endpoints require explicit authentication levels such as RPC_C_AUTHN_LEVEL_PKT_INTEGRITY or higher.

Attack Vector

Exploitation requires local access and low privileges, with no user interaction. An authenticated attacker on the target host binds to the vulnerable RPC endpoint and issues a crafted call to the unauthenticated procedure. Because the call executes within a privileged service process, the operation is performed with that service's token, yielding privilege escalation. Refer to the Microsoft Security Update Guide for interface-level technical details.

// No verified public proof-of-concept is available for CVE-2026-42976.
// See the Microsoft Security Update Guide for authoritative technical details.

Detection Methods for CVE-2026-42976

Indicators of Compromise

Unexpected child processes spawned by RPC service hosts such as svchost.exe running under SYSTEM after invocation from a low-privileged user session.
New or modified privileged services, scheduled tasks, or local accounts created shortly after suspicious RPC activity.
Anomalous loading of RPC client libraries (for example rpcrt4.dll) by user-mode processes that do not typically perform RPC calls.

Detection Strategies

Monitor Windows Event Logs for privilege assignment events (Event ID 4672) and process creation events (Event ID 4688) that link low-privileged parent sessions to SYSTEM child processes.
Enable RPC endpoint auditing where supported and alert on unauthenticated binds to sensitive interfaces.
Correlate token elevation and integrity-level transitions from Medium to High or System without an accompanying UAC prompt or legitimate service trigger.

Monitoring Recommendations

Baseline normal RPC interface usage per host and alert on statistically rare interface UUIDs called from interactive user sessions.
Track patch compliance across all listed Windows client and server SKUs to identify unpatched hosts exposed to local users.
Feed process, authentication, and RPC telemetry into a centralized analytics pipeline to detect chained local exploitation patterns.

How to Mitigate CVE-2026-42976

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide for CVE-2026-42976 to every affected Windows client and server.
Prioritize multi-user systems such as Remote Desktop Session Hosts, jump servers, and shared workstations where local users are most likely to trigger the flaw.
Audit and remove unnecessary local accounts and interactive logon rights to reduce the pool of authorized attackers who can reach the RPC surface.

Patch Information

Microsoft has issued patches for all supported affected versions through the Security Update Guide. The advisory covers Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (24H2, 25H2, 26H1), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025. Consult the Microsoft advisory for the specific KB article and build number applicable to each SKU.

Workarounds

Restrict local logon on high-value systems using Group Policy User Rights Assignment to limit which accounts can reach the local attack surface.
Apply host-based firewall rules and RPC filters to block or restrict access to non-essential RPC interfaces where operationally feasible.
Enforce application allowlisting to prevent execution of unapproved binaries that could stage exploitation of the vulnerable RPC endpoint.

bash

# Example: block inbound RPC endpoint mapper access from non-management subnets
netsh advfirewall firewall add rule name="Restrict RPC EPM" ^
    dir=in action=block protocol=TCP localport=135 ^
    remoteip=any profile=any