CVE-2026-45487

What it actually does

This is a local elevation-of-privilege vulnerability in the Windows Program Compatibility Assistant Service caused by a time-of-check time-of-use race condition. A low-privileged, already-authenticated attacker can win a race between the service validating an object and later using it, potentially causing a privileged service operation to act on attacker-controlled content or paths. Successful exploitation can result in execution with elevated privileges, commonly up to SYSTEM-level authority, with high confidentiality, integrity, and availability impact on the local machine.

Why it matters to the business

If exploited, an attacker who has already gained a foothold on a Windows workstation or server could turn limited access into full control of that system. This can enable credential theft, disabling security tools, persistence, lateral movement, data access, or ransomware staging. The issue affects multiple supported Windows client and server versions, including Windows 10, Windows 11, Windows Server 2022, and Windows Server 2025. It is not currently listed in CISA KEV, has low EPSS, and has no reported mature public exploitation in the provided data, so urgency is lower than actively exploited vulnerabilities but still important for normal Windows patch cycles because local privilege escalation flaws are commonly chained with initial-access bugs.

How an attack unfolds

An attacker must first obtain local authenticated access to an affected Windows system, such as through phishing, stolen credentials, malware execution, or exploitation of a separate remote-access weakness. The attacker then triggers behavior handled by the Program Compatibility Assistant Service and attempts to manipulate the relevant file, path, handle, or object during the narrow window between when the service checks it and when the service later uses it. If the race is won, the service may perform a privileged action against attacker-controlled input. The attacker can use the elevated result to run code with higher privileges, modify protected system areas, create persistence, dump credentials, disable defenses, or move laterally. Because this is a local privilege escalation issue, it is most dangerous when combined with an initial compromise technique.

How to fix it

Apply the relevant Microsoft security update for the affected Windows version as soon as it is available through Windows Update, Microsoft Update Catalog, WSUS, Intune, Configuration Manager, or the organization’s standard patch management platform. No exact fixed build numbers were provided in the input, so remediation should be verified against Microsoft’s official Security Update Guide and the installed OS build/revision. Prioritize systems where local compromise has high impact, including servers, administrator workstations, jump hosts, shared workstations, VDI images, and systems used by privileged users. Where immediate patching is not possible, reduce risk by enforcing least privilege, limiting interactive logon rights, restricting local administrator membership, using application control, blocking untrusted executable content, ensuring EDR tamper protection is enabled, and monitoring for privilege escalation behavior. Disabling the Program Compatibility Assistant Service may break compatibility workflows and should only be considered after operational testing and vendor guidance.

How to confirm the fix worked

Confirm that each affected Windows endpoint or server is running an OS build that includes the Microsoft security update addressing this vulnerability. Validate through centralized patch compliance reporting, Windows Update history, installed cumulative update KBs, vulnerability scanner results, and direct OS build checks using trusted administrative tooling. Re-scan with an authenticated vulnerability scanner after patch deployment. Confirm that golden images, VDI templates, offline images, recovery images, and server templates have also been updated. For mitigation validation, review that standard users do not have unnecessary local administrator rights, application control policies are enforced where applicable, and endpoint telemetry is collecting process creation, service creation, scheduled task, logon, and privilege-use events.

Typical attack path

1. Gain local authenticated access to an affected Windows 10, Windows 11, or Windows Server system.
2. Run a local exploit that interacts with or triggers the Program Compatibility Assistant Service.
3. Exploit the TOCTOU race by changing an object after validation but before privileged use.
4. Cause the privileged service operation to act on attacker-controlled content or a substituted target.
5. Obtain elevated local privileges, potentially SYSTEM-level execution.
6. Use the new privileges to establish persistence, access credentials, disable defenses, or support lateral movement.

How to detect it

There are no definitive public exploit-specific indicators in the provided data, so detection should focus on behavioral evidence of local privilege escalation and post-exploitation. Review Windows Security logs, System logs, PowerShell logs, Sysmon or EDR telemetry, and service-control telemetry for activity where a low-privileged user session is followed by SYSTEM-level process execution, new service creation, scheduled task creation, local administrator group modification, credential dumping attempts, or security tool tampering. Useful Windows events include process creation events such as Security 4688 or Sysmon Event ID 1; privileged logon indicators such as Security 4672; service installation events such as System 7045 or Security 4697; scheduled task creation such as Security 4698; local user and group changes such as Security 4720, 4732, and 4738; and PowerShell execution events such as 4103 and 4104. Pay particular attention to elevated processes launched from user-writable directories, unexpected child processes associated with service-hosted Windows components, and any suspicious activity temporally related to Program Compatibility Assistant Service activity. Since exploitation requires local access, correlate suspicious privilege escalation events with preceding initial-access indicators such as unusual interactive logons, remote logons, malware detections, phishing payload execution, or abnormal use of remote management tools.

• PcaSvc
• Program Compatibility Assistant Service
• C:\Windows\System32\pcasvc.dll
• Security Event ID 4688
• Security Event ID 4672
• Security Event ID 4697
• Security Event ID 4698
• Security Event ID 4720
• Security Event ID 4732
• System Event ID 7045
• PowerShell Event ID 4103
• PowerShell Event ID 4104
• Sysmon Event ID 1

What your security team should do

• Track Microsoft’s Security Update Guide for the exact fixed builds and deploy the applicable cumulative updates through the normal Windows patch process.
• Prioritize remediation on internet-facing servers, high-value servers, administrator workstations, jump hosts, and systems used by privileged users.
• Use authenticated vulnerability scanning and patch compliance reporting to identify Windows 10, Windows 11, Windows Server 2022, and Windows Server 2025 systems that remain exposed.
• Harden local privilege boundaries by removing unnecessary local administrator rights and limiting interactive logon to servers.
• Increase monitoring for local privilege escalation behavior, especially low-privileged users spawning elevated processes, new services, new scheduled tasks, or new local administrators.
• Ensure EDR and Windows security logging capture process creation, command line, service installation, scheduled task creation, and account management events.
• Review recent endpoint alerts for suspicious activity involving the Program Compatibility Assistant Service or unexpected SYSTEM-level process launches from user-writable locations.
• If exploitation intelligence changes, such as KEV listing, ransomware use, public exploit release, or EPSS increase, raise remediation priority immediately.