CVE-2026-45597

What it actually does

This vulnerability is a local privilege escalation issue in Microsoft Windows UI Automation Manager, implemented in uiamanager.dll. The flaw is a race condition caused by improper synchronization when shared resources are accessed concurrently. A low-privileged, authorized local attacker who can run code on an affected Windows system may be able to win the race condition and cause the component to perform operations with elevated privileges. Successful exploitation can result in compromise of confidentiality, integrity, and availability on the local machine, consistent with high-impact privilege escalation. The CVSS vector indicates local access, low privileges required, no user interaction, high attack complexity, and high impact across confidentiality, integrity, and availability.

Why it matters to the business

If exploited, this flaw can allow an attacker who already has limited access to a Windows workstation or server to gain higher privileges, potentially enabling credential theft, security control tampering, lateral movement, data access, malware deployment, or persistence. Because affected platforms include current Windows 11 releases and Windows Server 2022/2025, exposure may be broad across enterprise endpoints and servers. The current EPSS score is low and there is no known KEV listing or reported ransomware use, but local privilege escalation vulnerabilities are commonly chained with phishing, malware execution, remote code execution, or stolen credentials to complete a compromise.

How an attack unfolds

An attacker first obtains the ability to execute code as a low-privileged user on an affected Windows system. This initial access could come from malware execution, abuse of valid credentials, exploitation of another vulnerability, or interactive local access. The attacker then runs exploit code designed to interact with Windows UI Automation Manager in a way that triggers concurrent access to a shared resource handled by uiamanager.dll. By repeatedly invoking the vulnerable code path and carefully timing operations, the attacker attempts to win the race condition. If successful, the Windows component performs a sensitive action under an unintended security context, allowing the attacker to elevate from a standard user context to a higher-privileged local context. After elevation, the attacker may dump credentials, disable defenses, install persistence, access protected data, or use the host as a staging point for broader compromise. There is no public exploit maturity indicated and exploitation is expected to require reliable local execution and race-condition timing.

How to fix it

Apply the Microsoft security update that remediates CVE-2026-45597 for all affected Windows versions, including Windows 11 23H2, 24H2, 25H2, 26H1, Windows Server 2022, and Windows Server 2025. No exact fixed build numbers were provided in the input, so administrators should rely on the relevant Microsoft Security Update Guide entry, Windows Update, WSUS, Microsoft Configuration Manager, or equivalent patch-management tooling to deploy the latest cumulative update for each affected platform. Where immediate patching is not possible, reduce exposure by limiting interactive logon rights, removing unnecessary local administrator paths, enforcing least privilege, applying application control to prevent untrusted code execution, monitoring for privilege-escalation behavior, and prioritizing systems where low-privileged users or service accounts can execute arbitrary binaries. Because this is a local privilege escalation issue, network blocking alone is not an effective mitigation.

How to confirm the fix worked

Validate remediation by confirming that affected Windows systems have installed the Microsoft cumulative security update that includes the fix for this vulnerability. Use centralized patch compliance reporting, Windows Update history, WSUS or Configuration Manager compliance state, or PowerShell-based inventory to verify that systems are on a fixed cumulative update level. Confirm that uiamanager.dll has been updated to the version delivered by the relevant fixed Windows build for the platform. Where feasible, compare OS build and revision levels against Microsoft’s published fixed build information. Also verify that standard users cannot write to protected system paths, load unsigned or unapproved exploit tooling, or gain elevated tokens through local testing. For exposure assessment, enumerate Windows 11 23H2/24H2/25H2/26H1 and Windows Server 2022/2025 assets that have not received the applicable June 2026 or later cumulative security update.

Typical attack path

1. Gain local code execution on an affected Windows 11 or Windows Server system as a low-privileged user.
2. Confirm the target OS build includes the vulnerable UI Automation Manager component.
3. Run exploit code that repeatedly exercises the vulnerable uiamanager.dll code path.
4. Manipulate timing or concurrency to trigger the race condition against the shared resource.
5. Obtain elevated local privileges if the race is won successfully.
6. Use elevated access to perform follow-on actions such as credential access, defense evasion, persistence, data access, or lateral movement.

How to detect it

There are no known public exploit indicators, named threat actors, KEV listing, or ransomware association provided for this vulnerability, and local race-condition privilege escalation usually does not leave a unique network signature. To investigate possible exploitation, review endpoint telemetry and Windows event logs for suspicious local privilege changes following execution by a low-privileged user. Useful sources include EDR process telemetry, Windows Security logs, Sysmon logs, PowerShell logs, Windows Defender or other endpoint protection alerts, application control logs, and file integrity monitoring. Look for unusual processes that rapidly spawn child processes, unexpected transitions from medium-integrity user processes to high-integrity or SYSTEM-level processes, newly created services, scheduled tasks, driver loads, credential dumping activity, or security tool tampering shortly after execution of unknown binaries. Correlate suspicious activity with image loads of uiamanager.dll where available, but treat this as contextual rather than definitive evidence. Additional artifacts to review include newly dropped executables in user-writable directories, unexpected service creation events, new local administrator membership, anomalous token privileges, LSASS access attempts, and post-exploitation behaviors such as registry persistence or lateral movement tooling.

What your security team should do

• Prioritize deployment of the relevant Microsoft cumulative security update across affected Windows client and server versions, especially shared workstations, jump hosts, developer systems, and servers allowing interactive logon.
• Use endpoint management tooling to identify Windows 11 23H2, 24H2, 25H2, 26H1, Windows Server 2022, and Windows Server 2025 systems that are missing the applicable security update.
• Treat this as a privilege-escalation risk that may be chained with malware, phishing, remote access compromise, or another vulnerability; prioritize hosts already exposed to untrusted users or code execution.
• Review local administrator group membership, service account privileges, interactive logon permissions, and endpoint hardening baselines to reduce the value of local escalation.
• Enable or tune endpoint detection for suspicious token manipulation, unexpected child processes spawned from user contexts with elevated integrity, credential dumping attempts, and security control tampering after a low-privileged process executes.
• Monitor Microsoft advisories for fixed build numbers, exploitability assessment updates, or evidence of public exploit availability, because race-condition exploit reliability can change once proof-of-concept code is released.
• If patching must be delayed, enforce application control, restrict script interpreters and unsigned binaries, and increase monitoring on unpatched systems.