CVE-2026-58628: Windows 10 1809 Privilege Escalation Flaw

CVE-2026-58628 Overview

CVE-2026-58628 is a race condition vulnerability in the Windows Wireless Networking component. The flaw stems from concurrent execution using a shared resource with improper synchronization [CWE-362]. An authenticated local attacker can exploit the timing window to elevate privileges on the affected host.

Microsoft assigned this issue a CVSS 3.1 base score of 7.8 with vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H. Successful exploitation crosses a security scope boundary, giving the attacker elevated impact on confidentiality, integrity, and availability. The vulnerability affects supported Windows client and server releases, including Windows 10, Windows 11, and Windows Server 2019 through 2025.

Critical Impact

Local attackers who win the race condition can escalate to higher privileges and achieve full system compromise on unpatched Windows hosts.

Affected Products

• Microsoft Windows 10 (1809, 21H2, 22H2) across x86, x64, and ARM64 architectures
• Microsoft Windows 11 (24H2, 25H2, 26H1) on x64 and ARM64
• Microsoft Windows Server 2019, Server 2022, and Server 2025

Discovery Timeline

• 2026-07-14 - CVE-2026-58628 published to the National Vulnerability Database (NVD)
• 2026-07-17 - Last updated in NVD database

Technical Details for CVE-2026-58628

Vulnerability Analysis

The vulnerability resides in the Windows Wireless Networking subsystem, which handles wireless adapter state, profile management, and connection lifecycle events. The affected code path accesses a shared resource without correct locking, allowing two threads to operate on the same object concurrently. When an attacker interleaves operations at the right moment, the shared state becomes inconsistent.

The attack complexity is high because exploitation requires precise timing to hit the narrow race window. An attacker must already hold local, low-privileged access on the target. Once the race is won, the flaw permits code paths that would normally be gated by higher privilege to execute in a privileged context.

Because the scope is changed, the compromised component can influence resources beyond its original security boundary. This typically translates to SYSTEM-level code execution on Windows, providing full control over the host.

Root Cause

The root cause is improper synchronization of a shared resource within the Wireless Networking stack. Two or more execution flows can read and mutate the same object without a mutex or interlocked primitive protecting the critical section. This class of defect is tracked as [CWE-362] Concurrent Execution using Shared Resource with Improper Synchronization.

Attack Vector

Exploitation requires local access and valid low-privileged credentials on the target system. The attacker triggers wireless networking operations while a second thread manipulates the associated shared object. Successful exploitation does not require user interaction. No verified public proof-of-concept code is currently available for CVE-2026-58628, and Microsoft has not reported exploitation in the wild.

See the Microsoft Security Update CVE-2026-58628 advisory for vendor technical details.

Detection Methods for CVE-2026-58628

Indicators of Compromise

• Unexpected child processes spawned by wireless networking service host processes such as svchost.exe hosting WlanSvc
• New services, scheduled tasks, or accounts created shortly after wireless configuration API calls from a non-administrative user
• Abnormal loading of wireless-related DLLs from user-writable paths

Detection Strategies

• Hunt for local processes that repeatedly invoke wireless configuration APIs (WlanSetProfile, WlanSetInterface, WlanConnect) in tight loops, which can indicate race-window brute forcing
• Correlate WLAN AutoConfig service activity with subsequent token elevation events (Windows Event ID 4672) originating from unprivileged user sessions
• Use behavioral analytics to flag privilege elevation chains that begin with wireless subsystem calls

Monitoring Recommendations

• Enable Microsoft-Windows-WLAN-AutoConfig operational and diagnostic event logs and forward them to a central SIEM
• Monitor Security channel Event IDs 4688 (process creation) and 4672 (special privileges assigned) for anomalies tied to wlansvc.dll
• Alert on modifications to wireless profile storage under %ProgramData%\Microsoft\Wlansvc\Profiles\Interfaces\

How to Mitigate CVE-2026-58628

Immediate Actions Required

• Apply the Microsoft security update for CVE-2026-58628 to all affected Windows client and server systems as soon as testing allows
• Prioritize patching on multi-user hosts, jump servers, and laptops where low-privileged users have interactive access
• Audit local user accounts and remove unnecessary interactive logon rights to reduce the population of potential attackers

Patch Information

Microsoft published the fix through the Microsoft Security Response Center. Refer to the Microsoft Security Update CVE-2026-58628 guide for KB numbers, applicable builds, and superseded updates for each Windows release listed above.

Workarounds

• Where wireless connectivity is not required, disable the WLAN AutoConfig service (WlanSvc) via Group Policy or services.msc until patches are deployed
• Restrict which users can modify wireless profiles using Group Policy settings under Network > WLAN Service
• Enforce application control (Windows Defender Application Control or AppLocker) to limit unsigned binaries that could be used to trigger the race condition

# Disable the WLAN AutoConfig service on systems that do not require Wi-Fi
sc.exe config WlanSvc start= disabled
sc.exe stop WlanSvc