CVE-2026-49170

What it actually does

This is a local privilege-escalation vulnerability in the Windows StateRepository API caused by insufficiently granular access control. An attacker who already has the ability to run code as a low-privileged local user can abuse improper authorization boundaries in the StateRepository interface to gain higher privileges on the same Windows system. Successful exploitation can provide high-impact access to confidentiality, integrity, and availability, potentially allowing the attacker to read protected data, modify system state, install persistent tooling, disable defenses, or execute commands with elevated privileges. The CVSS vector indicates local access is required, attack complexity is low, no user interaction is required, and the impact is limited to the compromised host rather than automatically crossing trust boundaries.

Why it matters to the business

If exploited, this vulnerability can turn an initial low-privilege foothold on a Windows workstation or server into administrative control of that machine. For businesses, this increases the risk from phishing, credential theft, malware execution, insider misuse, and compromised standard user accounts because an attacker may be able to bypass normal least-privilege controls after initial access. Affected platforms include widely deployed Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, and Windows Server 2025 releases, so exposure may be broad across endpoint and server fleets. It is not currently listed in CISA KEV, is not identified as ransomware-used, and no public exploit maturity is reported, but the low-complexity local elevation path warrants timely patching because privilege-escalation bugs are commonly chained with remote access, phishing, browser, document, or credential-based intrusion techniques.

How an attack unfolds

An attacker first obtains local code execution on an affected Windows system, typically through stolen credentials, malware, phishing, abuse of a standard user account, exploitation of another vulnerability, or interactive access. Because this flaw requires only low privileges and no user interaction once the attacker is present, the attacker can invoke or manipulate the vulnerable Windows StateRepository API in a way that bypasses intended access-control granularity. If successful, the attacker gains elevated privileges on the local host. With those privileges, the attacker can dump credentials, access protected files, modify security settings, install services or scheduled tasks for persistence, tamper with logging or endpoint security controls, and use the compromised system as a stronger foothold for lateral movement. No named threat actors or active exploitation campaigns are currently identified in the supplied intelligence, and exploit maturity is listed as none, so detection should focus on suspicious post-exploitation behavior rather than a known exploit signature.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-49170 for all affected Windows versions, including Windows 10 1809, 21H2, and 22H2; Windows 11 24H2, 25H2, and 26H1; Windows Server 2019; Windows Server 2022; and Windows Server 2025. Because no exact fixed build or KB version was provided, use Microsoft Security Update Guide, Windows Update, WSUS, Microsoft Configuration Manager, Intune, or the organization’s patch-management platform to identify and deploy the applicable cumulative update for each OS release. Prioritize internet-facing servers, jump hosts, administrator workstations, VDI pools, shared workstations, systems used by privileged users, and endpoints with high exposure to email, browser, or document-based attack paths. Where immediate patching is not possible, reduce risk by enforcing least privilege, removing unnecessary local administrator rights, hardening endpoint protection, enabling tamper protection, restricting interactive logon to servers, applying application control where feasible, monitoring suspicious privilege escalation behavior, and isolating high-risk unpatched systems. There is no reliable configuration-only workaround that should be treated as equivalent to patching.

How to confirm the fix worked

Confirm remediation by verifying that each affected Windows system has installed the Microsoft cumulative update or security update that includes the fix for this vulnerability. Validate through centralized patch inventory, Windows Update history, WSUS/Configuration Manager/Intune compliance reports, or command-line checks such as querying installed hotfixes and OS build information. Compare installed OS builds and update levels against Microsoft’s Security Update Guide for the relevant Windows release. For servers and critical endpoints, perform a second validation pass after reboot because Windows cumulative updates often require restart completion before the patched components are active. Exposure validation should identify unsupported or out-of-date Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, and Windows Server 2025 systems that have not received the applicable July 2026 or later security update containing the fix. Avoid relying on exploit tests in production unless provided by a trusted vendor and approved through change-control, because local privilege-escalation proof-of-concepts can alter host state or create security risk.

Typical attack path

1. Gain initial access to an affected Windows workstation or server using phishing, stolen credentials, malware, physical/interactive access, or a separate vulnerability.
2. Establish code execution as a low-privileged local user.
3. Invoke or abuse the vulnerable Windows StateRepository API path to bypass insufficient access-control checks.
4. Obtain elevated local privileges on the affected system.
5. Use elevated privileges to access protected data, dump credentials, disable security tools, install persistence, or modify system configuration.
6. Optionally use harvested credentials or elevated host access to move laterally or expand control within the environment.

How to detect it

There are no supplied public exploit indicators, named threat actors, KEV exploitation confirmation, or known ransomware use for this vulnerability, so detection should focus on behavioral evidence of local privilege escalation and follow-on activity. Review Windows Security logs for unusual privilege assignment, new local administrator membership, new service creation, scheduled task creation, abnormal process launches from user-writable directories, and suspicious use of administrative tools by non-administrative users. Relevant log sources include Windows Security Event Log, System Event Log, PowerShell Operational logs, Sysmon if deployed, EDR telemetry, Microsoft Defender alerts, Windows Task Scheduler Operational logs, service-control events, local group membership changes, and authentication logs. Investigate sequences where a low-privileged user process is followed by elevated child processes, service installation, credential access attempts, disabling of security controls, or administrative logons that do not match normal user behavior. On unpatched hosts, pay particular attention to activity involving Windows StateRepository-related components or abnormal interaction with app state repository services combined with privilege changes. Since no exploit-specific artifacts are known, absence of these indicators does not prove non-exploitation; use timeline analysis, EDR process ancestry, and account privilege-change review to assess suspicious hosts.

What your security team should do

• Prioritize deployment of the applicable Microsoft security update across affected Windows endpoints and servers, especially systems used by administrators, shared-access systems, and servers that can provide a path to broader compromise.
• Create a patch-compliance report for all affected Windows versions and track systems missing the fixed cumulative update until remediation is complete.
• Hunt for signs of suspicious local privilege escalation and post-exploitation activity on unpatched systems, focusing on new services, scheduled tasks, credential-dumping behavior, security-control tampering, and unexpected administrator-group changes.
• Review and reduce local administrator privileges, especially for standard users on workstations and service accounts on servers.
• Ensure endpoint detection and response, Microsoft Defender, tamper protection, PowerShell logging, command-line logging, and Windows Security auditing are enabled on high-risk systems.
• Restrict interactive logon and remote administration rights on servers to approved administrative groups only.
• Use application control or attack-surface reduction policies to reduce the likelihood that a low-privileged foothold can execute tooling needed to exploit or operationalize the vulnerability.
• Because exploit maturity is currently listed as none and the vulnerability is not in KEV, patch on a risk-based but timely schedule rather than delaying until public exploit code appears.