CVE-2026-32162

What it actually does

This is a local Windows COM privilege-escalation vulnerability caused by COM accepting extraneous untrusted data alongside trusted data. A local, unauthorized attacker can abuse the flaw to cause a privileged COM component or COM-mediated operation to process attacker-controlled input as if it were trusted, resulting in execution or action at a higher integrity level. The CVSS vector indicates local attack, low complexity, no required privileges, no user interaction, and high confidentiality, integrity, and availability impact, meaning successful exploitation can provide full local system compromise on affected Windows clients and servers.

Why it matters to the business

Successful exploitation could allow an attacker who has code execution on a Windows endpoint or server to become a highly privileged local user, disable security controls, steal sensitive data, install persistence, tamper with applications, or move laterally. Because the affected product set spans supported Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, and Windows Server 2025 versions, enterprise exposure may be broad. The vulnerability is not currently listed in CISA KEV, has no known exploit maturity in the provided data, and EPSS is low and flat, but the high severity and no-privilege local exploitation characteristics make timely patching important, especially on shared workstations, VDI, jump hosts, developer systems, and servers where local code execution could be chained with initial access.

How an attack unfolds

An attacker first needs the ability to run code locally on an affected Windows system, such as through malware execution, a malicious script, abuse of a standard user account, or chaining from another vulnerability that provides local execution. The attacker then invokes or interacts with a vulnerable Windows COM path and supplies crafted untrusted data that is incorrectly accepted together with trusted COM data. If the vulnerable COM component processes that data in a privileged context, the attacker can elevate from an unprivileged or low-integrity context to a higher-privileged local context, potentially SYSTEM or an administrator-equivalent token depending on the vulnerable path. After elevation, the attacker typically performs post-exploitation actions such as dumping credentials, disabling endpoint security, creating persistence, modifying protected files or registry keys, and using the host as a staging point for lateral movement.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-32162 for all affected Windows versions, including Windows 10 1809, 21H2, and 22H2; Windows 11 23H2, 24H2, 25H2, and 26H1; Windows Server 2019; Windows Server 2022 including 23H2; and Windows Server 2025. No exact fixed build numbers were provided, so use Microsoft Update, WSUS, Microsoft Configuration Manager, Intune, or the Microsoft Update Catalog to deploy the cumulative security update released for this vulnerability or any later cumulative update. Prioritize internet-facing servers, jump hosts, domain administration workstations, shared multi-user systems, VDI pools, build systems, and endpoints with elevated operational importance. If immediate patching is not possible, reduce risk by limiting local interactive access, enforcing application control, blocking untrusted script execution, removing unnecessary local administrator rights, enabling attack surface reduction rules, and closely monitoring COM-related process activity and privilege changes.

How to confirm the fix worked

Confirm that each affected Windows host has installed the cumulative security update that contains the fix or a later cumulative update. Validate through Windows Update history, PowerShell inventory, endpoint management compliance reports, or vulnerability scanner plugin results mapped to this CVE. Where available, compare OS build and patch level against Microsoft’s official release notes for the relevant Windows edition. After remediation, rescan with authenticated vulnerability scanning and verify the CVE is no longer reported. For high-risk systems, also verify that endpoint protection remains active, local administrator group membership is expected, and no unexplained new services, scheduled tasks, startup items, privileged processes, or persistence artifacts appeared before patching.

Typical attack path

1. Gain local code execution on an affected Windows workstation or server through phishing, malware, a compromised account, or another exploit.
2. Run a crafted local program or script that interacts with the vulnerable Windows COM functionality.
3. Supply malformed or extraneous attacker-controlled data that is incorrectly accepted with trusted COM data.
4. Trigger a privileged COM component or service to process the attacker-controlled data.
5. Obtain elevated local execution, potentially with administrator or SYSTEM-level privileges.
6. Use the elevated access to disable defenses, access sensitive files, dump credentials, install persistence, or pivot to other systems.

How to detect it

Because the provided information does not identify a public exploit, unique exploit strings, file names, registry keys, or network indicators, detection should focus on behavioral evidence of local privilege escalation and post-exploitation. Review Windows Security logs, Sysmon, PowerShell logs, EDR telemetry, and application control logs for low-privileged users launching COM-related processes followed by elevated command execution, credential access, service creation, scheduled task creation, security tool tampering, or unexpected local administrator group changes. Useful Windows events include process creation events such as Security 4688 or Sysmon Event ID 1, privilege assignment and special logon events such as 4672, service installation events such as 4697 or System 7045, scheduled task events such as 4698 and TaskScheduler Operational 106/140, local group membership changes such as 4732, and PowerShell events such as 4103 and 4104. Investigate sequences where dllhost.exe, svchost.exe hosting DCOM, or other COM-related processes spawn shells, scripting engines, credential tools, or binaries from user-writable paths. Also review EDR detections for token manipulation, UAC bypass-like behavior, suspicious COM activation, unexpected integrity-level transitions, and protected registry or file modifications by a previously low-privileged user. Since this is a local privilege-escalation issue, network logs alone are unlikely to prove exploitation unless correlated with prior initial access or subsequent lateral movement.

• dllhost.exe spawning cmd.exe
• dllhost.exe spawning powershell.exe
• dllhost.exe spawning pwsh.exe
• dllhost.exe spawning wscript.exe
• dllhost.exe spawning cscript.exe
• dllhost.exe spawning rundll32.exe
• dllhost.exe spawning regsvr32.exe
• svchost.exe -k DcomLaunch spawning cmd.exe
• svchost.exe -k DcomLaunch spawning powershell.exe
• Event ID 4688 AND ParentImage=*\\dllhost.exe AND Image=*\\cmd.exe
• Event ID 4688 AND ParentImage=*\\dllhost.exe AND Image=*\\powershell.exe
• Sysmon Event ID 1 AND ParentImage=*\\dllhost.exe AND Image=*\\cmd.exe
• Sysmon Event ID 1 AND ParentImage=*\\dllhost.exe AND Image=*\\powershell.exe
• Event ID 4672 followed by suspicious process creation from the same account
• Event ID 4697 service installed after dllhost.exe activity
• System Event ID 7045 service installed after dllhost.exe activity
• Event ID 4698 scheduled task created after dllhost.exe activity
• Event ID 4732 local Administrators group membership changed after suspicious COM activity
• PowerShell Event ID 4104 with Start-Process -Verb runAs
• PowerShell Event ID 4104 with Add-MpPreference -ExclusionPath
• PowerShell Event ID 4104 with Set-MpPreference -DisableRealtimeMonitoring

What your security team should do

• Patch affected Windows clients and servers with the applicable Microsoft cumulative security update or a later update, prioritizing servers, privileged access workstations, shared systems, and endpoints used by administrators.
• Use endpoint management or vulnerability management tooling to produce an inventory of exposed Windows versions and track remediation coverage until all supported affected versions are compliant.
• Treat this primarily as a post-compromise privilege-escalation risk: harden initial-access controls, restrict local code execution, enforce least privilege, and remove unnecessary local administrator rights.
• Enable and review process creation logging, PowerShell logging, Windows Defender/EDR telemetry, and security event logs for suspicious COM host activity and unexpected privilege escalation behavior.
• Hunt for suspicious child processes spawned by COM-related hosts such as dllhost.exe, elevated command shells, credential-access tools, new services, and new scheduled tasks around the time of suspected compromise.
• Where patching is delayed, apply compensating controls such as application control, attack surface reduction rules, constrained scripting, EDR prevention mode, and tighter access controls on shared or high-value Windows systems.