CVE-2026-61358: Windows 10 1809 Privilege Escalation Flaw

CVE-2026-61358 Overview

CVE-2026-61358 is an elevation of privilege vulnerability in the Windows Accessibility Infrastructure component, specifically ATBroker.exe. The flaw stems from improper link resolution before file access, classified as [CWE-59] link following. An authorized local attacker can exploit the weakness to gain higher privileges on affected Windows client and server systems. Microsoft published the advisory on 2026-08-11, and the issue affects a broad range of supported Windows 10, Windows 11, and Windows Server releases.

Critical Impact
A locally authenticated attacker can abuse symbolic link handling in ATBroker.exe to write or manipulate files in privileged locations, resulting in high impact to confidentiality, integrity, and availability.

Affected Products

Microsoft Windows 10 (1809, 21H2, 22H2) on x86, x64, and ARM64
Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1) on x64 and ARM64
Microsoft Windows Server 2019, 2022, and 2025

Discovery Timeline

2026-08-11 - CVE-2026-61358 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-61358

Vulnerability Analysis

The Accessibility Broker service ATBroker.exe mediates access between assistive technology clients and the Windows session. It runs with elevated privileges to bridge user-mode accessibility tools with protected components of the operating system. The vulnerability occurs because the broker resolves file paths without properly validating whether those paths traverse symbolic links, junctions, or hard links. A local attacker with standard user rights can plant a link that redirects the broker's file operation to a target the attacker could not otherwise modify.

Root Cause

The defect maps to [CWE-59], improper link resolution before file access. Windows APIs used by ATBroker.exe open or write files using paths that the attacker can influence, without opening the target with flags such as FILE_FLAG_OPEN_REPARSE_POINT or verifying the final file identity after resolution. When the broker acts on the path, the operating system follows the reparse point and the privileged process performs the action against an attacker-chosen location.

Attack Vector

Exploitation requires local access with low privileges and no user interaction. An attacker prepares a directory under their control, races the broker to place a junction or symbolic link, and triggers accessibility functionality that causes ATBroker.exe to touch the crafted path. The privileged file write, delete, or overwrite that follows can be used to plant a DLL in a system-loaded location, corrupt a protected configuration file, or replace a service binary, resulting in elevation to SYSTEM. No verified public exploit code has been published, but the EPSS score of 3.3% places the CVE in the 87th percentile for likelihood of exploitation activity.

No verified public proof-of-concept code is available. See the Microsoft Security Update CVE-2026-61358 advisory for vendor technical details.

Detection Methods for CVE-2026-61358

Indicators of Compromise

Creation of symbolic links, junctions, or hard links by non-administrative processes in directories subsequently accessed by ATBroker.exe.
Unexpected file writes performed by ATBroker.exe outside of standard accessibility configuration paths.
New or modified DLLs or executables in privileged directories with timestamps aligning to accessibility feature activation.
Child processes spawned by ATBroker.exe that deviate from documented assistive technology binaries.

Detection Strategies

Monitor process telemetry for ATBroker.exe performing file operations on paths located in user-writable directories such as %LOCALAPPDATA%\Temp or %USERPROFILE%.
Alert on reparse point creation events (Sysmon Event ID 11 with reparse attributes, or Windows Event ID 4663 with ReparsePoint object access) followed by broker activity within a short time window.
Correlate accessibility feature invocation (Ease of Access, Narrator, Magnifier) with subsequent privileged file writes on the same host.

Monitoring Recommendations

Enable object access auditing for sensitive system directories and forward events to a central SIEM for correlation.
Baseline ATBroker.exe behavior across the fleet to identify hosts where the process performs anomalous file operations.
Track patch deployment status for the August 2026 Windows security update across all in-scope Windows 10, Windows 11, and Windows Server builds.

How to Mitigate CVE-2026-61358

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-61358 to all affected Windows 10, Windows 11, and Windows Server systems.
Prioritize patching on multi-user systems such as Remote Desktop Services hosts, Citrix hosts, and shared workstations where local users are present.
Audit local user and service account privileges to reduce the population of accounts that meet the low-privilege prerequisite for exploitation.
Restrict the ability of standard users to create symbolic links by reviewing the SeCreateSymbolicLinkPrivilege assignment in Group Policy.

Patch Information

Microsoft released a security update addressing CVE-2026-61358. The patch modifies file access logic in ATBroker.exe to validate link targets before performing privileged operations. Refer to the Microsoft Security Update CVE-2026-61358 guidance for build-specific KB article numbers and deployment instructions.

Workarounds

Where accessibility features are not required, disable optional assistive technology components through Group Policy to reduce the exposed attack surface.
Enforce Attack Surface Reduction rules that block credential theft and suspicious child processes originating from Windows binaries.
Limit interactive logon rights on servers so that only administrators can authenticate locally, reducing the pool of accounts eligible to exploit the flaw.

bash

# Configuration example: audit symbolic link privilege assignment
secedit /export /cfg C:\Temp\secpol.cfg
findstr /I "SeCreateSymbolicLinkPrivilege" C:\Temp\secpol.cfg