CVE-2026-49170 Overview
CVE-2026-49170 is a local privilege escalation vulnerability in the Windows StateRepository API. Insufficient granularity of access control [CWE-285] allows an authenticated attacker to elevate privileges on affected systems. The flaw impacts multiple supported versions of Windows 10, Windows 11, and Windows Server editions. Microsoft has published a security advisory and released patches through its Security Update Guide.
An attacker with local, low-privileged access can abuse the API to perform actions reserved for higher-privilege accounts. Successful exploitation yields high impact to confidentiality, integrity, and availability on the target host.
Critical Impact
A local authenticated attacker can escalate privileges through the StateRepository API and gain full control over confidentiality, integrity, and availability of the affected Windows host.
Affected Products
- Microsoft Windows 10 (1809, 21H2, 22H2)
- Microsoft Windows 11 (24H2, 25H2, 26H1)
- Microsoft Windows Server 2019, 2022, and 2025
Discovery Timeline
- 2026-07-14 - CVE-2026-49170 published to NVD
- 2026-07-16 - Last updated in NVD database
Technical Details for CVE-2026-49170
Vulnerability Analysis
The Windows StateRepository is a system service that stores metadata about installed applications, packages, and user state. Its API is exposed to local processes and enforces access checks to distinguish operations available to standard users from those restricted to privileged callers.
This vulnerability stems from insufficient granularity of access control within that API. Certain operations do not sufficiently distinguish between the privilege level of the caller and the sensitivity of the requested action. A low-privileged, authenticated user can invoke functionality that should be restricted to higher-privileged principals.
The issue is exploitable locally without user interaction. Because the StateRepository interacts with privileged system components, successful abuse yields elevated privileges on the local host.
Root Cause
The root cause is an improper authorization weakness [CWE-285] in the StateRepository API. Access control checks do not enforce sufficiently fine-grained restrictions on specific operations, allowing an authenticated caller to reach code paths intended for privileged contexts.
Attack Vector
Exploitation requires local access and valid credentials on the target system. An attacker executes code as a standard user, then interacts with the StateRepository API to trigger the privileged code path. No user interaction is required beyond the attacker's own session. Refer to the Microsoft Security Update Guide for CVE-2026-49170 for vendor technical details.
Detection Methods for CVE-2026-49170
Indicators of Compromise
- Unexpected child processes spawned by StateRepository-related services or by processes hosting the StateRepository API.
- New or modified entries in the StateRepository database (StateRepository-Machine.srd) written by non-privileged user contexts.
- Standard user accounts suddenly performing actions requiring SYSTEM or administrator privileges shortly after interacting with AppX or package APIs.
Detection Strategies
- Monitor process ancestry for privilege transitions where a low-integrity process is followed by SYSTEM-level activity without an intervening legitimate elevation event.
- Alert on unusual API calls to StateRepository interfaces from unsigned or non-standard binaries.
- Correlate Windows Security event IDs 4672 and 4688 to identify unexpected privilege assignments tied to StateRepository client processes.
Monitoring Recommendations
- Enable process creation auditing (Event ID 4688) with command-line logging across all affected Windows versions.
- Ingest Sysmon events (Event IDs 1, 10, and 11) into a central analytics platform to detect anomalous access to StateRepository files and handles.
- Baseline normal StateRepository activity per host and alert on deviations from that baseline.
How to Mitigate CVE-2026-49170
Immediate Actions Required
- Apply Microsoft's security update for CVE-2026-49170 to all affected Windows 10, Windows 11, and Windows Server systems.
- Prioritize patching multi-user hosts, jump servers, and Remote Desktop Session Hosts where local users are more likely to attempt privilege escalation.
- Audit local user accounts and remove unnecessary interactive logon rights on high-value systems.
Patch Information
Microsoft has released a security update addressing this vulnerability. Refer to the Microsoft Security Update Guide for CVE-2026-49170 for KB article numbers, build versions, and installation guidance specific to each affected Windows release.
Workarounds
- No vendor-approved workaround is documented; patching is the supported remediation.
- Reduce risk by restricting local logon to trusted administrators until updates are deployed.
- Enforce application allowlisting with Windows Defender Application Control or AppLocker to limit which binaries can invoke the StateRepository API.
# Configuration example: verify patch deployment via PowerShell
Get-HotFix | Where-Object { $_.InstalledOn -ge (Get-Date).AddDays(-30) } | Sort-Object InstalledOn -Descending
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
