CVE-2026-58540

What it actually does

This is a local privilege escalation flaw in Windows Installer caused by improper authorization checks. A user who can already run code on an affected Windows system may be able to abuse Windows Installer behavior to perform actions with higher privileges, potentially reaching administrative or SYSTEM-level control. Successful exploitation can compromise confidentiality, integrity, and availability on the local host, including access to protected files, modification of system settings, installation of services, or disabling of security controls.

Why it matters to the business

The vulnerability does not provide initial remote access by itself, but it can significantly increase the impact of a phishing compromise, stolen low-privilege account, malware infection, or insider misuse. If exploited, an attacker could turn limited access into full control of Windows workstations or servers, enabling credential theft, persistence, lateral movement, data access, and disruption. The issue affects many supported Windows client and server versions, so exposure may be broad across enterprise fleets. It is not currently listed in CISA KEV, has no known public exploit maturity in the provided data, and has a low EPSS score, but the high local impact makes timely patching important, especially on shared systems, servers, administrator workstations, and endpoints used by privileged users.

How an attack unfolds

An attacker first needs local authenticated access to an affected Windows machine, such as through a compromised user account, malicious attachment, prior malware execution, exposed remote desktop access, or insider access. The attacker then invokes Windows Installer functionality with a crafted installer package, transform, repair operation, rollback condition, custom action, or other installation workflow that reaches the vulnerable authorization path. Because the Windows Installer service can perform certain operations with elevated privileges, the improper authorization may allow the attacker-controlled workflow to execute privileged actions that the original user should not be allowed to perform. After escalation, the attacker typically establishes persistence, dumps credentials, disables defenses, creates a local administrator account, installs a service, or uses the elevated context to move laterally. No named threat actor exploitation or ransomware use is indicated in the provided data.

How to fix it

Apply the Microsoft security update or latest cumulative update that addresses this vulnerability for all affected Windows versions, including Windows 10, Windows 11, Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. Because no exact fixed build numbers were provided, validate against Microsoft’s official security update guidance for the July 2026 release cycle or later cumulative updates. Prioritize systems where local compromise has high consequence: domain controllers, file servers, management servers, jump hosts, shared workstations, administrator endpoints, VDI hosts, and internet-facing systems that allow interactive logon. As compensating controls, restrict local interactive and remote logon rights, limit who can install software, enforce application control for MSI/MSP execution, block untrusted installers from user-writable directories, monitor or disable risky installer policy configurations, and ensure the AlwaysInstallElevated registry policy is not enabled unless explicitly required and controlled.

How to confirm the fix worked

Confirm that affected Windows systems have installed the Microsoft cumulative or security update that includes the fix. Use enterprise patch tools such as Windows Update for Business, WSUS, Microsoft Configuration Manager, Intune, vulnerability scanners, or endpoint management inventory to compare OS versions and installed update levels against Microsoft’s advisory. Verify that unsupported or extended-support operating systems are either receiving applicable security updates or are isolated and scheduled for retirement. Confirm that the registry values for AlwaysInstallElevated are not enabled under HKLM and HKCU unless there is a documented business exception. For technical validation, test from a standard non-administrative account that untrusted MSI/MSP packages cannot perform privileged changes, create services, write to protected directories, modify protected registry keys, or spawn elevated child processes through Windows Installer.

Typical attack path

1. Gain local authenticated access to an affected Windows workstation or server.
2. Stage a crafted MSI-related payload or invoke Windows Installer functionality in a way that reaches the vulnerable authorization path.
3. Trigger Windows Installer to perform an operation that is incorrectly allowed for the low-privilege user.
4. Obtain elevated local privileges, potentially administrative or SYSTEM-level execution.
5. Use the elevated access to install persistence, add accounts, dump credentials, disable security tooling, access protected data, or pivot to other systems.

How to detect it

To determine whether this vulnerability was already exploited, review endpoint and Windows logs for suspicious Windows Installer activity followed by privileged changes. Useful sources include Windows Security logs, Application logs with MsiInstaller events, Sysmon telemetry, EDR process trees, PowerShell logs, service control manager logs, scheduled task logs, local group membership changes, and file/registry monitoring. Look for msiexec.exe launched by unusual parent processes such as browsers, Office applications, script interpreters, archive tools, or processes running from user-writable locations. Investigate msiexec.exe executing from or installing content in Temp, Downloads, AppData, ProgramData, network shares, or other non-standard locations. Correlate installer activity with new local administrator membership, new services, scheduled tasks, changes to security tools, credential dumping behavior, or unexpected SYSTEM-level command shells. Since no public exploit indicators or actor-specific artifacts were provided, prioritize behavior-based detection rather than relying on a single filename, hash, or network indicator.

• msiexec.exe
• MsiInstaller
• Event ID 1033
• Event ID 1034
• Event ID 11707
• Event ID 11708
• Event ID 4688
• Event ID 4672
• Event ID 4697
• Event ID 4698
• Event ID 7045
• Event ID 4720
• Event ID 4732
• AlwaysInstallElevated
• HKLM\Software\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated
• HKCU\Software\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated
• \AppData\Local\Temp\
• \Users\Public\
• \Downloads\
• \ProgramData\
• msiexec.exe /i
• msiexec.exe /qn
• msiexec.exe /quiet
• msiexec.exe /update
• msiexec.exe /package
• msiexec.exe /repair
• powershell.exe
• cmd.exe
• sc.exe create
• net localgroup administrators

What your security team should do

• Inventory all affected Windows client and server versions and identify unpatched systems.
• Prioritize patching high-value systems, shared endpoints, administrator workstations, servers, and any host that permits local or remote interactive logon.
• Deploy the applicable Microsoft cumulative/security updates and track completion through endpoint management and vulnerability scanning.
• Harden Windows Installer usage by restricting untrusted MSI/MSP execution, especially from Downloads, Temp, network shares, and user profile directories.
• Audit and disable AlwaysInstallElevated policy settings where present, unless explicitly justified and tightly controlled.
• Monitor for suspicious msiexec.exe activity, especially executions from user-writable paths, unusual parent/child process relationships, service creation, local administrator group changes, or security tool tampering.
• Review recent endpoint telemetry for signs of local privilege escalation followed by credential access, persistence, or lateral movement.
• Apply least privilege to user accounts and remove unnecessary local administrator rights to reduce post-exploitation impact.