CVE-2026-72945: Windows Task Scheduler Information Disclosure

CVE-2026-72945 is an information disclosure vulnerability in Windows Task Scheduler caused by uninitialized resource usage. Authorized attackers can exploit this flaw locally to access sensitive data. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-72945 Overview

CVE-2026-72945 is an information disclosure vulnerability in Windows Task Scheduler caused by the use of an uninitialized resource [CWE-908]. An authorized local attacker can exploit the flaw to read memory contents that should not be exposed. The vulnerability affects the confidentiality of the host but does not allow modification of data or disruption of service.

Microsoft published the advisory on 2026-09-08 and last updated it on the same day. The Microsoft Security Update CVE-2026-72945 provides remediation details.

Critical Impact
Local authenticated attackers can disclose sensitive in-memory data through Windows Task Scheduler, potentially exposing information useful for further privilege escalation or lateral movement.

Affected Products

Windows Task Scheduler (see the Microsoft Security Update Guide for the complete list of affected Windows builds)

Discovery Timeline

2026-09-08 - CVE-2026-72945 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-72945

Vulnerability Analysis

The vulnerability exists in Windows Task Scheduler, the operating system component that manages scheduled tasks and their triggers. Task Scheduler reads from a resource that has not been fully initialized before use, resulting in previously allocated memory contents being returned to a caller. An authorized local user can invoke the affected code path and receive data left over in memory from prior operations.

The impact is limited to confidentiality. Successful exploitation does not modify system state or crash the service, but leaked memory may contain credentials, handles, tokens, or configuration data that assist follow-on attacks.

Root Cause

The root cause is classified under [CWE-908] Use of Uninitialized Resource. Task Scheduler allocates or references a memory structure without explicitly zeroing or populating it before returning its contents to the requesting process. Whatever residual data occupies that memory region is disclosed to the caller.

Attack Vector

Exploitation requires local access and low-privileged authenticated credentials on the target Windows system. No user interaction is required. The attacker interacts with Task Scheduler through supported interfaces to trigger the uninitialized read and capture the returned data.

No public proof-of-concept code has been published, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog. Refer to the Microsoft Security Update CVE-2026-72945 for technical specifics.

Detection Methods for CVE-2026-72945

Indicators of Compromise

No public indicators of compromise have been published for CVE-2026-72945 at the time of this advisory.
Unexpected local processes that repeatedly query Task Scheduler interfaces may warrant investigation.

Detection Strategies

Monitor for anomalous invocation of Task Scheduler COM interfaces or the schtasks.exe binary from non-administrative user contexts.
Correlate local logon events with subsequent Task Scheduler API activity to identify low-privilege accounts accessing scheduler resources abnormally.
Apply behavioral analytics to identify processes reading Task Scheduler data structures outside of standard administrative workflows.

Monitoring Recommendations

Enable Windows event logging for the Microsoft-Windows-TaskScheduler/Operational channel and forward events to a centralized SIEM.
Track process creation events (Event ID 4688) referencing scheduler binaries and correlate with the invoking user.
Alert on repeated failed or unusual Task Scheduler queries from standard user accounts.

How to Mitigate CVE-2026-72945

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide entry for CVE-2026-72945 as soon as testing permits.
Prioritize patching on multi-user systems, terminal servers, and workstations where non-administrative accounts have interactive access.
Audit local account privileges and remove unnecessary interactive logon rights from standard users.

Patch Information

Microsoft has issued a security update addressing CVE-2026-72945. Deploy the applicable update via Windows Update, Windows Server Update Services (WSUS), or your enterprise patch management platform. Verify installation using the KB article referenced in the Microsoft Security Update Guide.

Workarounds

No official workaround has been published by Microsoft. Applying the vendor patch is the recommended remediation.
Restrict local logon rights and enforce least privilege to reduce the pool of accounts capable of triggering the vulnerability.
Monitor and audit Task Scheduler activity until systems are fully patched.

bash

# Verify installation of the applicable Microsoft security update
# Replace KBXXXXXXX with the KB number from the Microsoft Security Update Guide
wmic qfe list brief /format:table | findstr KBXXXXXXX

# Alternatively, use PowerShell
Get-HotFix -Id KBXXXXXXX