CVE-2026-45487: Windows 10 Privilege Escalation Flaw

CVE-2026-45487 Overview

CVE-2026-45487 is a time-of-check time-of-use (TOCTOU) race condition in the Microsoft Windows Program Compatibility Assistant (PCA) Service. The flaw allows an authorized local attacker to elevate privileges on affected Windows desktop and server systems. Microsoft published the advisory on June 9, 2026, tracking the issue under CWE-367. The weakness affects multiple supported Windows 10, Windows 11, and Windows Server releases.

Critical Impact
A local authenticated attacker who wins the race window against the PCA Service can elevate to SYSTEM, gaining full confidentiality, integrity, and availability impact on the host.

Affected Products

Microsoft Windows 10 21H2 and 22H2 (x86, x64, ARM64)
Microsoft Windows 11 23H2, 24H2, 25H2, 26H1 (x64, ARM64)
Microsoft Windows Server 2022 and Windows Server 2025

Discovery Timeline

2026-06-09 - CVE-2026-45487 published to NVD
2026-06-11 - Last updated in NVD database

Technical Details for CVE-2026-45487

Vulnerability Analysis

The Program Compatibility Assistant Service (PcaSvc) runs with SYSTEM privileges and monitors application execution to apply compatibility shims. The service performs a security or state check on a resource and then operates on that resource in a separate step. An attacker who modifies the resource between these two operations can cause the privileged service to act on attacker-controlled data.

Exploitation requires local access and valid user credentials. The attacker must win a narrow timing window, which raises the attack complexity, but successful exploitation yields full SYSTEM-level code execution. Confidentiality, integrity, and availability are all impacted on the compromised host.

Root Cause

The root cause is a classic TOCTOU flaw classified under CWE-367: Time-of-check Time-of-use Race Condition. The PCA Service validates a resource — likely a file path, handle, or registry object — and later uses it without re-validation. A local attacker can swap the resource between check and use by manipulating symbolic links, file system reparse points, or object handles in user-writable locations.

Attack Vector

The attacker executes a low-privilege process that triggers PCA Service activity, typically by launching an application that the service inspects. While the service performs its check-then-use sequence, the attacker races to replace the inspected resource with a crafted target such as a symlink pointing to a SYSTEM-owned path. When the service performs the privileged operation, it writes to, reads from, or executes the attacker-controlled target with SYSTEM rights. Refer to the Microsoft CVE-2026-45487 Advisory for vendor technical context.

Detection Methods for CVE-2026-45487

Indicators of Compromise

Unexpected child processes spawned by pcasvc.dll hosted under svchost.exe -k LocalSystemNetworkRestricted.
New or modified files in SYSTEM-owned directories (C:\Windows\System32, C:\Windows\AppPatch) created shortly after PCA Service activity from a low-privilege user session.
Creation of symbolic links, junctions, or hard links in user-writable paths (%LOCALAPPDATA%, %TEMP%) immediately before PCA-triggering application launches.

Detection Strategies

Hunt for processes running as SYSTEM whose parent is svchost.exe hosting PcaSvc and whose image path resides in a user-writable directory.
Alert on rapid sequences of CreateFile, DeleteFile, and CreateSymbolicLink operations targeting the same path from a non-elevated process.
Correlate Windows Event ID 4688 (process creation) with file system minifilter telemetry to identify race-condition exploitation patterns.

Monitoring Recommendations

Enable Sysmon Event IDs 1, 11, and 15 to capture process creation, file creation, and stream hash changes around PCA Service activity.
Monitor the HKLM\SYSTEM\CurrentControlSet\Services\PcaSvc registry path for unexpected configuration changes.
Track abnormal privilege escalations where a standard user session is followed by SYSTEM-context process creation within seconds.

How to Mitigate CVE-2026-45487

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-45487 to all affected Windows 10, Windows 11, and Windows Server hosts.
Prioritize patching multi-user systems, terminal servers, and Virtual Desktop Infrastructure hosts where local users have interactive logon rights.
Audit local account membership and remove unnecessary interactive logon privileges to reduce the population of users who can attempt local exploitation.

Patch Information

Microsoft addressed CVE-2026-45487 in the security update referenced by the Microsoft CVE-2026-45487 Advisory. Administrators should consult the advisory for the specific KB article and cumulative update applicable to each Windows build listed in the affected products.

Workarounds

If patching must be delayed, restrict interactive logon to trusted administrators using Group Policy User Rights Assignment settings.
Consider disabling the Program Compatibility Assistant Service (PcaSvc) on hardened servers that do not require application compatibility shimming, after validating operational impact.
Enforce application allow-listing with Windows Defender Application Control to limit the binaries a low-privilege user can launch to trigger the race condition.

bash

# Configuration example: query and stop the PCA Service on systems where it is not required
sc.exe query PcaSvc
sc.exe config PcaSvc start= disabled
sc.exe stop PcaSvc