CVE-2026-61936 Overview
CVE-2026-61936 is a missing authorization vulnerability in the Windows Defender Firewall Service. An authorized local attacker can bypass a security feature enforced by the firewall service and modify protected state. The weakness is tracked under CWE-862: Missing Authorization.
The flaw affects Windows 10, Windows 11, and Windows Server 2019 through 2025. Microsoft published the advisory on August 11, 2026 and has released a fix through the standard update channel.
Critical Impact
A locally authenticated user can bypass firewall-enforced security controls, alter integrity-protected configuration, and weaken host isolation on affected Windows and Windows Server systems.
Affected Products
- Microsoft Windows 10 (1809, 21H2, 22H2) across x86, x64, and ARM64
- Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1) across x64 and ARM64
- Microsoft Windows Server 2019, Windows Server 2022, and Windows Server 2025
Discovery Timeline
- 2026-08-11 - CVE-2026-61936 published to NVD
- 2026-08-11 - Microsoft releases security update via the MSRC advisory
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-61936
Vulnerability Analysis
The Windows Defender Firewall Service (MpsSvc) exposes configuration and control interfaces that must enforce authorization before applying state changes. CVE-2026-61936 stems from a missing authorization check on one of those code paths. An authenticated local user can invoke the affected functionality without holding the privileges the design intended to require.
The attack impacts integrity only. Confidentiality and availability are not directly affected. However, tampering with firewall enforcement removes a defensive layer that other host-based controls depend on, expanding follow-on attack options for local malware or a foothold user account.
Because the attack vector is local and requires low privileges, this vulnerability is most relevant in post-compromise scenarios, shared workstation environments, and multi-tenant Remote Desktop hosts where non-administrative accounts are present.
Root Cause
The underlying weakness is CWE-862: Missing Authorization. A code path within the firewall service performs a privileged operation without validating that the calling principal has the rights required to perform it. Authentication alone is treated as sufficient, so any interactive or service-context user on the host can reach the operation.
Attack Vector
Exploitation requires local access and a valid low-privilege account on the target system. The attacker interacts with the firewall service through its exposed interface and triggers the vulnerable operation to bypass the enforced security feature. No user interaction is required, and the scope remains unchanged. See the Microsoft advisory for vendor-provided details.
No public proof-of-concept and no known in-the-wild exploitation have been reported at the time of writing.
Detection Methods for CVE-2026-61936
Indicators of Compromise
- Unexpected changes to Windows Defender Firewall rules, profiles, or IPsec policy on hosts where administrative activity is not scheduled
- Firewall service configuration writes originating from non-administrative user sessions
- Sudden disablement of a firewall profile (Domain, Private, or Public) on servers or managed endpoints
Detection Strategies
- Monitor Windows Event Log channel Microsoft-Windows-Windows Firewall With Advanced Security/Firewall for rule add, modify, and delete events (event IDs 2004, 2005, 2006, 2033) correlated with the invoking user SID
- Alert on Security event ID 4950 and 4954, which record firewall setting and Group Policy setting changes
- Baseline MpsSvc-related registry writes under HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy and flag modifications by non-administrator tokens
Monitoring Recommendations
- Ship firewall and Security event logs to a central analytics platform and retain long enough to investigate lateral movement
- Track netsh advfirewall, PowerShell Set-NetFirewallProfile, and Set-NetFirewallRule execution by non-administrative accounts
- Correlate firewall configuration changes with subsequent inbound or outbound connection anomalies on the same host
How to Mitigate CVE-2026-61936
Immediate Actions Required
- Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-61936 to all affected Windows 10, Windows 11, and Windows Server systems
- Prioritize patching multi-user hosts, Remote Desktop Session Hosts, and jump servers where local low-privilege accounts exist
- Audit local account inventory and remove unnecessary interactive logon rights on servers
Patch Information
Microsoft has issued fixes through Windows Update. Administrators should deploy the corresponding cumulative update for each affected build (Windows 10 1809/21H2/22H2, Windows 11 23H2/24H2/25H2/26H1, and Windows Server 2019/2022/2025). Verify installation with Get-HotFix or by confirming the OS build number matches the fixed release listed in the MSRC advisory.
Workarounds
- Restrict local logon rights and Remote Desktop access on servers to reduce the pool of users who can trigger the flaw
- Enforce least privilege for service accounts so that a compromised account cannot reach the vulnerable interface
- Use Group Policy or Intune to centrally enforce firewall configuration and rapidly detect drift on managed endpoints until patching completes
# Verify the update is installed and confirm current OS build
systeminfo | findstr /B /C:"OS Version" /C:"OS Name"
wmic qfe list brief /format:table
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
