CVE-2026-72958: Windows Credential Guard Privilege Escalation

CVE-2026-72958 Overview

CVE-2026-72958 is a double free vulnerability [CWE-415] in Windows Credential Guard. An authorized local attacker can exploit the flaw to elevate privileges on an affected Windows system. Microsoft has published an advisory tracking this issue through the Microsoft Security Response Center (MSRC).

The vulnerability requires local access and high privileges to exploit, but successful exploitation results in a scope change with high impact to confidentiality, integrity, and availability. Attackers targeting Credential Guard can compromise the isolated LSA process that safeguards derived credentials such as NTLM hashes and Kerberos tickets.

Critical Impact
Successful exploitation elevates privileges beyond the current security boundary, enabling access to protected credentials managed by Windows Credential Guard.

Affected Products

Microsoft Windows (Credential Guard component)
Windows Server editions with Credential Guard enabled
Windows client editions with Virtualization-Based Security (VBS) enabled

Discovery Timeline

2026-09-08 - CVE-2026-72958 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-72958

Vulnerability Analysis

The vulnerability is a double free condition in Windows Credential Guard, tracked under CWE-415: Double Free. Credential Guard uses Virtualization-Based Security to isolate the Local Security Authority (LSA) process, protecting cached credentials from extraction by attackers on the host operating system.

A double free occurs when a program calls a memory deallocation routine twice on the same allocation. This corrupts heap metadata and can allow an attacker to manipulate subsequent allocations. In a component such as Credential Guard, which straddles the trust boundary between the normal OS and the isolated user mode, this corruption can be leveraged to elevate privileges across the virtualization boundary.

The attack vector is local, and the attacker must already hold high privileges on the machine. However, the scope change indicates that exploitation impacts resources beyond the initially compromised security context, consistent with breaking out of a lower-privileged process into the protected Credential Guard environment.

Root Cause

The root cause is improper memory lifecycle management within the Credential Guard code path. A memory allocation is freed twice, likely due to an error in cleanup logic or a shared pointer that is not nulled after the first release. Attackers who trigger the code path can influence heap layout between the two free operations.

Attack Vector

Exploitation requires local, authenticated access with elevated privileges. The attacker interacts with the vulnerable Credential Guard interface to trigger the double free, shape the heap, and gain arbitrary write primitives that lead to privilege elevation. Public exploit code is not currently available, and the flaw is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

No verified proof-of-concept has been released. Refer to the Microsoft CVE-2026-72958 Advisory for authoritative technical details.

Detection Methods for CVE-2026-72958

Indicators of Compromise

Unexpected crashes or Windows Error Reporting entries referencing LsaIso.exe or Credential Guard components
Anomalous child processes spawning from LSA-related services on systems with Credential Guard enabled
Kernel event logs indicating heap corruption or invalid free operations tied to the secure kernel

Detection Strategies

Monitor Windows Event Log channels for repeated failures or restarts of the isolated LSA process
Correlate local privilege escalation attempts with prior high-privilege authentication events on the same host
Hunt for unsigned or suspicious binaries invoking Credential Guard APIs from non-standard code paths

Monitoring Recommendations

Enable and centralize Windows Defender Exploit Guard and kernel telemetry for Credential Guard components
Alert on modifications to VBS or Credential Guard registry configuration keys under HKLM\SYSTEM\CurrentControlSet\Control\LSA
Track administrative logon sessions and correlate with subsequent process creation events tied to LSA interfaces

How to Mitigate CVE-2026-72958

Immediate Actions Required

Apply the security update referenced in the Microsoft CVE-2026-72958 Advisory as soon as it is released for affected builds
Inventory Windows hosts with Credential Guard enabled and prioritize patching for domain controllers, privileged access workstations, and jump hosts
Restrict membership in local administrator groups to limit which accounts can meet the high-privilege precondition

Patch Information

Microsoft has published guidance for CVE-2026-72958 through the MSRC Update Guide. Administrators should consult the advisory to identify the correct cumulative update for each affected Windows edition and deploy it through Windows Update, Windows Server Update Services (WSUS), or Microsoft Intune.

Workarounds

Enforce least privilege so that day-to-day accounts do not hold the local administrative rights required for exploitation
Use tiered administration and privileged access workstations to separate high-value credentials from general-purpose systems
Monitor for local privilege escalation behavior on hosts where the patch cannot be immediately deployed

bash

# Verify Credential Guard status on a Windows host
Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard | \
  Select-Object SecurityServicesConfigured, SecurityServicesRunning