CVE-2026-66804 Overview
CVE-2026-66804 is an improper access control vulnerability [CWE-284] in the Windows Cross Device Service. An authorized local attacker can exploit this weakness to elevate privileges on an affected Windows host. Microsoft published the advisory on August 11, 2026, and the entry was last updated on August 12, 2026.
The flaw requires local access and low privileges but no user interaction. Successful exploitation compromises confidentiality, integrity, and availability of the target system. The Exploit Prediction Scoring System (EPSS) places this vulnerability in the 86th percentile of exploitation likelihood, indicating meaningful attacker interest despite no confirmed in-the-wild activity.
Critical Impact
A local, authenticated attacker can elevate to higher privileges on the affected Windows host, gaining full control over confidentiality, integrity, and availability.
Affected Products
- Microsoft Windows (Cross Device Service component)
- Refer to the Microsoft Vulnerability Advisory CVE-2026-66804 for the authoritative list of affected builds
Discovery Timeline
- 2026-08-11 - CVE-2026-66804 published to the National Vulnerability Database (NVD)
- 2026-08-12 - Last updated in the NVD database
Technical Details for CVE-2026-66804
Vulnerability Analysis
The Windows Cross Device Service supports cross-device experiences such as Phone Link, clipboard sync, and file sharing between Windows and companion devices. The service exposes interfaces and objects that must enforce strict access checks because it runs with elevated privileges. CVE-2026-66804 stems from improper access control [CWE-284] within this component.
An attacker who already holds a low-privilege account on the host can interact with the service in a manner it does not properly restrict. The interaction allows the attacker to perform operations reserved for higher-privileged principals. The result is local privilege escalation with full impact on confidentiality, integrity, and availability.
Root Cause
The root cause is a missing or insufficient authorization check on a code path within the Cross Device Service. When a low-privileged caller invokes the affected path, the service performs privileged work on the caller's behalf without validating that the caller is entitled to trigger it. Microsoft has not disclosed the specific interface or object at fault.
Attack Vector
Exploitation requires local access with an authenticated user context. No user interaction and no social engineering are needed. The attacker executes code on the target, invokes the vulnerable service path, and receives execution or object access at a higher integrity level. This class of flaw is commonly chained with a remote initial access primitive (phishing, drive-by, or a foothold from another vulnerability) to reach SYSTEM or administrative privileges.
No public proof-of-concept is currently available. See the Microsoft Vulnerability Advisory CVE-2026-66804 for vendor guidance.
Detection Methods for CVE-2026-66804
Indicators of Compromise
- Unexpected child processes spawned by the Windows Cross Device Service host process running at higher integrity than the invoking user
- Access token manipulation or impersonation events tied to Cross Device Service interfaces
- New or modified files, scheduled tasks, or services created shortly after Cross Device Service activity by non-administrative users
Detection Strategies
- Hunt for local privilege escalation patterns: a medium or low integrity process interacting with the Cross Device Service, followed by SYSTEM-level activity in the same session
- Correlate Windows Security event IDs 4672 (special privileges assigned) and 4688 (process creation) with the Cross Device Service parent to surface anomalous elevation
- Deploy behavioral endpoint detection and response (EDR) rules that flag standard users triggering privileged Cross Device Service operations
Monitoring Recommendations
- Enable command-line auditing and PowerShell script block logging on Windows endpoints to capture post-exploitation actions
- Forward Windows Security, Sysmon, and application logs to a SIEM for correlation across privilege boundaries
- Track the patch state of the Cross Device Service across the fleet and alert on hosts running unpatched builds
How to Mitigate CVE-2026-66804
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft Vulnerability Advisory CVE-2026-66804 as soon as it is available for your Windows build
- Prioritize patching on multi-user hosts, developer workstations, and jump servers where local accounts are most exposed
- Review local account inventories and remove unnecessary interactive logon rights to reduce the pool of potential attackers
Patch Information
Microsoft has published guidance for CVE-2026-66804 through the Microsoft Security Response Center. Administrators should consult the Microsoft Vulnerability Advisory CVE-2026-66804 for the KB numbers, affected Windows versions, and any prerequisites specific to their deployment.
Workarounds
- Where the Cross Device Service is not required for business use, disable or restrict the associated Windows features (for example, Phone Link and cross-device clipboard) via Group Policy or Mobile Device Management
- Enforce the principle of least privilege so standard users cannot install software or run arbitrary local binaries
- Apply application control (Windows Defender Application Control or AppLocker) to block unauthorized local execution that would be required to trigger the vulnerable code path
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
