CVE-2026-65773 Overview
CVE-2026-65773 is an improper access control vulnerability [CWE-284] in the Microsoft Windows Kernel. An authenticated local attacker can exploit the flaw to elevate privileges on affected systems. The issue affects a broad range of supported Windows client and server releases, including Windows 10, Windows 11, and Windows Server editions from 2019 through 2025. Microsoft published the advisory on 2026-08-11 and the entry was last modified on 2026-08-13. The vulnerability requires local access and low privileges but no user interaction, and it impacts confidentiality, integrity, and availability.
Critical Impact
A successful exploit lets a standard local user gain SYSTEM-level privileges on the Windows Kernel, enabling full control of the affected host.
Affected Products
- Microsoft Windows 10 (1809, 21H2, 22H2) across x86, x64, and ARM64 builds
- Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1) across x64 and ARM64 builds
- Microsoft Windows Server 2019, Windows Server 2022, and Windows Server 2025
Discovery Timeline
- 2026-08-11 - CVE-2026-65773 published to NVD
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-65773
Vulnerability Analysis
CVE-2026-65773 stems from improper access control within the Windows Kernel. The kernel fails to correctly enforce authorization on a privileged operation or object, allowing a low-privileged process to access resources reserved for higher-privileged callers. The weakness is categorized under [CWE-284] Improper Access Control. Exploitation results in local privilege escalation with high impact on confidentiality, integrity, and availability. Microsoft's advisory identifies the vulnerability as an elevation of privilege issue affecting kernel-mode components across current Windows client and server releases. See the Microsoft CVE-2026-65773 Advisory for vendor guidance. At publication, EPSS estimates the probability of exploitation activity in the next 30 days at 0.248%.
Root Cause
The kernel does not adequately validate the security context or object permissions before granting access to a protected resource. This access-control gap enables an authorized user-mode caller to reach kernel functionality that should be gated by higher privileges.
Attack Vector
Exploitation requires local code execution as an authenticated user. No user interaction is needed. An attacker running a crafted program on the target system can invoke the vulnerable kernel path to escalate to SYSTEM. The flaw is commonly chained with initial-access techniques such as phishing or exploitation of a lower-privilege application to reach full host compromise.
No public proof-of-concept code has been released. Refer to the vendor advisory for technical details.
Detection Methods for CVE-2026-65773
Indicators of Compromise
- Unexpected creation of SYSTEM-owned processes originating from a standard-user session or non-elevated parent process.
- Loading of unsigned or unusual drivers, or new handles opened to sensitive kernel objects shortly before a privilege change.
- Local user accounts suddenly performing actions that require administrative rights, such as service creation or registry writes to HKLM\SYSTEM\CurrentControlSet\Services.
Detection Strategies
- Hunt for token manipulation patterns: processes whose integrity level or token owner changes to SYSTEM without an authorized elevation path.
- Correlate Sysmon Event ID 1 (process create) and Event ID 10 (process access) for unusual access to lsass.exe, csrss.exe, or ntoskrnl.exe from unprivileged binaries.
- Alert on Windows Security Event ID 4672 (special privileges assigned) issued to accounts that should not routinely receive them.
Monitoring Recommendations
- Ingest kernel driver load events (Event ID 6) and flag drivers loaded outside of normal patch cycles.
- Monitor for exploit-adjacent behavior such as repeated NtQuerySystemInformation calls that leak kernel addresses.
- Baseline privileged operations per host and alert on deviations, especially on servers where user-launched elevation is rare.
How to Mitigate CVE-2026-65773
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft CVE-2026-65773 Advisory to all affected Windows 10, Windows 11, and Windows Server systems.
- Prioritize patching multi-user hosts, jump servers, and endpoints accessible via remote sessions, where local privilege escalation has the greatest downstream impact.
- Audit local accounts and remove unnecessary interactive logon rights to reduce the attacker population capable of triggering the flaw.
Patch Information
Microsoft has released cumulative updates addressing CVE-2026-65773 for all listed Windows client and server versions. Administrators should install the corresponding monthly security rollup or standalone update through Windows Update, WSUS, Microsoft Update Catalog, or their preferred patch management platform. Verify installation by checking that the current build number matches the fixed build documented in the vendor advisory.
Workarounds
- No official workaround is listed by Microsoft; patching is the supported remediation.
- Enforce the principle of least privilege and disable unused local accounts to limit who can execute code locally.
- Enable Windows Defender Attack Surface Reduction rules and Credential Guard to raise the cost of chaining this local privilege escalation with other techniques.
# Verify patch installation on Windows
wmic qfe list brief /format:table
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
