CVE-2026-58526

What it actually does

CVE-2026-58526 is a local privilege escalation vulnerability caused by a use-after-free condition in Windows Storage. An attacker who already has low-privileged local code execution can trigger incorrect handling of freed memory and potentially execute code with elevated privileges. Successful exploitation can provide high-impact access to confidentiality, integrity, and availability of the affected Windows system, consistent with the CVSS 7.0 rating. The attack requires local access, low privileges, no user interaction, and high attack complexity.

Why it matters to the business

If exploited, this vulnerability can turn an initial low-privilege foothold into administrative or SYSTEM-level control on affected Windows workstations or servers. That can allow attackers to disable security tools, dump credentials, modify or delete data, install persistence, and move laterally through the network. The issue affects many supported Windows client and server versions, including Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, and Windows Server 2025. It is not currently listed in CISA KEV, has no known exploit maturity, and has a low EPSS score, so immediate internet-scale exploitation is not indicated; however, local privilege escalation flaws are commonly used after phishing, malware execution, or exploitation of a separate remote-entry vulnerability.

How an attack unfolds

An attacker first obtains local execution on an affected Windows host, typically through phishing, malware, stolen credentials, or exploitation of another vulnerability. From that low-privileged context, the attacker runs exploit code that interacts with Windows Storage functionality in a way that causes memory to be freed while still being referenced. By carefully influencing memory reuse, the attacker attempts to redirect execution or corrupt privileged state so code runs in a higher-privileged context. If successful, the attacker gains elevated rights on the local machine, which can then be used to access protected files, dump credentials from memory, tamper with security controls, create privileged accounts or services, and support lateral movement. Because the vulnerability has high attack complexity and no public exploit maturity is reported, exploitation is expected to require reliable local exploit development rather than simple unauthenticated remote scanning.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-58526 for all affected Windows versions: Windows 10 1809, 21H2, and 22H2; Windows 11 24H2, 25H2, and 26H1; Windows Server 2019; Windows Server 2022; and Windows Server 2025. Use Windows Update, Windows Server Update Services, Microsoft Configuration Manager, Intune, or the Microsoft Update Catalog as appropriate. Because no fixed build numbers were provided in the input, validate against the Microsoft Security Update Guide for the exact KB and OS build applicable to each platform. Prioritize patching systems where local compromise would have high impact, including domain-joined endpoints, administrative workstations, virtualization hosts, file servers, backup servers, and systems used by privileged users. If immediate patching is not possible, reduce risk by enforcing least privilege, removing unnecessary local administrator rights, restricting interactive logon to servers, enabling endpoint protection, blocking untrusted executable content, and monitoring for local privilege escalation behavior.

How to confirm the fix worked

Confirm remediation by verifying that each affected Windows system has installed the Microsoft security update or cumulative update that supersedes it for the relevant OS version. Review installed updates with Windows Update history, Microsoft Defender Vulnerability Management, WSUS, Configuration Manager, Intune reporting, or PowerShell commands such as Get-HotFix and OS build checks. Compare installed KBs and build numbers against the Microsoft Security Update Guide entry for CVE-2026-58526. Validate exposure reduction by confirming affected Windows versions are no longer missing the applicable cumulative update. Where vulnerability scanners are used, run authenticated scans to ensure the scanner can inspect OS build and patch state accurately. For high-value systems, confirm that non-administrative users cannot perform administrative actions and review EDR telemetry for attempted local privilege escalation activity before and after patching.

Typical attack path

1. Gain initial local code execution on an affected Windows workstation or server using a separate technique such as phishing, malware delivery, valid credentials, or another vulnerability.
2. Confirm the host is running an affected Windows version and has not received the relevant security update.
3. Execute local exploit code from a low-privileged user context.
4. Trigger the Windows Storage use-after-free condition and manipulate memory state to obtain elevated execution.
5. Run commands or payloads with administrative or SYSTEM-level privileges.
6. Disable defenses, dump credentials, install persistence, or use the elevated access to move laterally to additional systems.

How to detect it

Detection should focus on evidence of attempted or successful local privilege escalation rather than remote exploitation, because this flaw requires local access. Review EDR telemetry, Sysmon, Windows Security logs, PowerShell logs, service creation events, scheduled task events, driver load events, and crash telemetry from affected Windows systems. Look for low-privileged user processes that unexpectedly spawn elevated command shells, create services, modify privileged files or registry locations, disable security tools, access credential material, or perform lateral movement shortly after execution. Useful Windows event sources include Security event IDs 4688 for process creation, 4672 for special privileges assigned to a new logon, 4624 for logon activity, 7045 in the System log for new service installation, 4698 for scheduled task creation, 1102 for audit log clearing, and PowerShell 4104 for script block logging. Also review Microsoft Defender or EDR alerts for privilege escalation, exploit behavior, suspicious memory manipulation, LSASS access, unsigned driver loading, security product tampering, and anomalous child processes from user-writable paths. There are no vulnerability-specific public exploit strings or filenames provided, so detections should be behavior-based and correlated with affected OS versions and missing patch status.

• Windows Security Event ID 4688: process creation from user-writable paths such as %TEMP%, %APPDATA%, %LOCALAPPDATA%, Downloads, or C:\Users\Public
• Windows Security Event ID 4672: Special privileges assigned to new logon
• Windows System Event ID 7045: A service was installed in the system
• Windows Security Event ID 4698: A scheduled task was created
• Windows Security Event ID 1102: The audit log was cleared
• PowerShell Event ID 4104
• Process access to lsass.exe
• reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
• sc.exe create
• schtasks.exe /create
• net localgroup administrators /add
• wevtutil cl Security
• powershell.exe -ExecutionPolicy Bypass
• cmd.exe /c whoami /priv
• vssadmin.exe delete shadows
• bcdedit.exe /set {default} safeboot minimal

What your security team should do

• Patch affected Windows client and server systems with the applicable Microsoft cumulative security update, prioritizing servers, administrator workstations, and systems with broad credential exposure.
• Use authenticated vulnerability scanning or endpoint management inventory to identify Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, and Windows Server 2025 systems missing the relevant update.
• Treat this primarily as a post-compromise privilege escalation risk: pair patching with controls that reduce initial access, including phishing-resistant MFA, application control, endpoint protection, and removal of unnecessary local administrator rights.
• Monitor EDR and Windows telemetry for suspicious low-privileged processes spawning elevated shells, creating services, dumping credentials, or tampering with security tools.
• Restrict interactive logon and local execution on servers to approved administrative groups only.
• Review recent incidents involving malware or unauthorized local execution on affected Windows systems for possible privilege escalation activity.
• Track Microsoft Security Update Guide updates for the exact KBs, supersedence information, and any later change in exploitability assessment.
• Because this vulnerability is not currently in CISA KEV, has no known exploit maturity, and has low EPSS, handle through normal high-priority patch operations rather than emergency KEV-driven response unless threat intelligence changes.