CVE-2026-58636: Microsoft PC Manager Privilege Escalation

CVE-2026-58636 Overview

CVE-2026-58636 is a local privilege escalation vulnerability in Microsoft PC Manager. The flaw stems from improper link resolution before file access, classified under [CWE-59]. An authorized local attacker can abuse symbolic or hard links to redirect privileged file operations to attacker-controlled locations. Successful exploitation lets a low-privileged user elevate to higher privileges on the affected Windows system.

Microsoft published the advisory on 2026-07-14. The vulnerability requires local access and low privileges but no user interaction. It impacts confidentiality, integrity, and availability at the operating system level.

Critical Impact
A local authenticated attacker can exploit link-following behavior in Microsoft PC Manager to elevate privileges, gaining full control over the affected host.

Affected Products

Microsoft PC Manager (all versions prior to the July 2026 security update)
Windows systems with Microsoft PC Manager installed
Environments where PC Manager runs with elevated service privileges

Discovery Timeline

2026-07-14 - CVE-2026-58636 published to NVD
2026-07-17 - Last updated in NVD database

Technical Details for CVE-2026-58636

Vulnerability Analysis

The vulnerability is a link-following flaw in Microsoft PC Manager. PC Manager performs privileged file operations without properly resolving or validating filesystem links before access. A local attacker can plant symbolic links, junctions, or hard links in paths the service will read, write, or delete. When PC Manager operates on these paths under a higher-privileged context, the file operation is redirected to a location chosen by the attacker.

This class of bug, tracked as [CWE-59], is a well-known local privilege escalation pattern on Windows. Common outcomes include arbitrary file write, arbitrary file deletion, or arbitrary DACL overwrite as NT AUTHORITY\SYSTEM. Any of these primitives is typically sufficient to achieve SYSTEM-level code execution through follow-on techniques such as DLL hijacking or planting content in privileged auto-load directories.

At the time of publication, no public proof-of-concept exploit is listed, and the vulnerability is not in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.267%.

Root Cause

The root cause is missing or insufficient reparse-point checks in PC Manager's privileged file handling code paths. The service opens files by path rather than by handle with FILE_FLAG_OPEN_REPARSE_POINT semantics, and does not validate that the final target resides outside user-writable directories. A standard user can therefore influence which file the privileged process ultimately touches.

Attack Vector

The attack requires local access with low privileges and no user interaction. An attacker identifies a file path that PC Manager writes to, deletes, or modifies during normal operation. The attacker replaces the target or a parent directory with a junction or symlink pointing to a sensitive system location. When PC Manager next performs the operation, it acts on the redirected path with its own privileges. See the Microsoft CVE-2026-58636 Advisory for vendor-supplied technical details.

Detection Methods for CVE-2026-58636

Indicators of Compromise

Creation of NTFS junctions, symbolic links, or hard links inside directories written to by MSPCManagerService.exe or related PC Manager binaries
Unexpected file writes or deletions in protected paths such as C:\Windows\System32 originating from PC Manager processes
New or modified DLLs in PC Manager's install directory or in known DLL search-order locations shortly after PC Manager activity

Detection Strategies

Monitor process activity from PC Manager binaries performing file operations on paths that traverse user-writable directories
Alert on use of CreateSymbolicLink, mklink /J, or SetReparsePoint from low-privileged user contexts targeting paths later accessed by services
Correlate PC Manager file operations with subsequent SYSTEM-level process creation from non-standard binaries

Monitoring Recommendations

Enable Windows object access auditing on PC Manager working directories and log reparse-point creations
Ingest Sysmon Event IDs 1, 11, and 27 into your SIEM to track suspicious file and link activity
Review endpoint telemetry for privilege transitions where a standard user process precedes SYSTEM-level file modification

How to Mitigate CVE-2026-58636

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-58636 Advisory to all systems running PC Manager
Inventory endpoints for Microsoft PC Manager installations and prioritize patching on multi-user or shared systems
Restrict interactive logon on servers and workstations where PC Manager is installed until patched

Patch Information

Microsoft has released a security update addressing CVE-2026-58636. Administrators should update Microsoft PC Manager to the latest version through the Microsoft Store or the vendor-supplied installer. Refer to the Microsoft CVE-2026-58636 Advisory for the exact fixed build number and deployment guidance.

Workarounds

Uninstall Microsoft PC Manager on systems where it is not required for business operations
Limit local logon rights so only trusted administrators can execute code on hosts running PC Manager
Disable the PC Manager service on unpatched systems to remove the privileged file-operation surface

bash

# Configuration example: check installed PC Manager version and stop the service on unpatched hosts
Get-AppxPackage -Name "Microsoft.PCManager" | Select-Object Name, Version
Stop-Service -Name "MSPCManagerService" -Force
Set-Service -Name "MSPCManagerService" -StartupType Disabled