CVE-2026-58545

What it actually does

CVE-2026-58545 is a local Windows Kernel improper access control vulnerability that allows an already authorized local attacker with low privileges to bypass a security feature. The CVSS vector indicates local access is required, exploitation is low complexity, no user interaction is needed, and the primary impact is high confidentiality loss. This means successful exploitation is most likely to let a local user or malware access information that should be protected by a Windows kernel-enforced security boundary, rather than directly causing integrity modification or denial of service.

Why it matters to the business

The main business risk is unauthorized disclosure of sensitive information from affected Windows workstations or servers after an attacker has already obtained local access. This could support credential theft, lateral movement, espionage, or follow-on compromise, especially on shared systems, administrator workstations, terminal servers, and high-value Windows servers. The vulnerability is not currently listed in CISA KEV, has low EPSS, and has no reported exploit maturity, so it is not currently a mass-exploitation signal; however, because it affects many supported Windows client and server versions, remediation should be handled through normal monthly Windows patching with prioritization for high-value assets.

How an attack unfolds

An attacker first needs a foothold on an affected Windows system as an authorized local user or as code running under a low-privileged account. They then invoke the vulnerable Windows Kernel behavior to bypass an intended access-control or security-feature restriction. If successful, the attacker gains access to protected information that should not be readable from their current privilege context. The exposed information may then be used to identify credentials, tokens, process memory, kernel-adjacent data, or other sensitive material useful for follow-on activity. Because the vulnerability does not provide remote initial access by itself, it is most relevant as a post-compromise capability used after phishing, malware execution, stolen credentials, exposed RDP/VPN access, or insider access.

How to fix it

Apply the relevant Microsoft security update for CVE-2026-58545 across affected Windows versions, including Windows 10, Windows 11, Windows Server 2012, 2016, 2019, 2022, and 2025. Because no specific fixed build numbers were provided, use Microsoft Security Update Guide, Windows Update, WSUS, Microsoft Configuration Manager, Intune, or equivalent patch-management tooling to identify and deploy the cumulative update that contains the fix. Prioritize systems where local code execution is more likely or more consequential, such as multi-user servers, jump hosts, administrator workstations, domain controllers, VDI platforms, and internet-facing Windows servers that could be compromised through a separate entry point. If immediate patching is not possible, reduce exposure by limiting local logon rights, removing unnecessary user accounts, enforcing application control, restricting script execution, enabling credential protections, and monitoring for suspicious local process execution.

How to confirm the fix worked

Confirm that each affected Windows system has installed the Microsoft cumulative update or security update that includes the fix for CVE-2026-58545. Validate through centralized patch inventory, Windows Update history, WSUS or Configuration Manager compliance reports, Intune device compliance, or PowerShell checks such as querying installed hotfixes and OS build numbers. Compare the installed build and update level against Microsoft’s official Security Update Guide for the affected Windows release. On representative systems, reboot if required and confirm the system remains on a patched build. Also verify compensating controls on unpatched systems, including least-privilege local access, endpoint detection coverage, application control, and logging for local process creation and privilege-sensitive activity.

Typical attack path

1. Gain local authenticated access to an affected Windows workstation or server through valid credentials, malware execution, or another vulnerability.
2. Run code locally under a low-privileged or otherwise restricted user context.
3. Trigger the Windows Kernel improper access-control condition to bypass a security feature.
4. Access protected information that should not be available to the attacker’s current privilege level.
5. Use the disclosed information to support credential theft, privilege escalation attempts, lateral movement, or further system reconnaissance.

How to detect it

There are no public, vulnerability-specific exploitation indicators provided for this issue, and exploitation is local, so detection should focus on signs of suspicious authenticated activity and post-compromise behavior on affected Windows systems. Review endpoint detection telemetry, Windows Security logs, Sysmon logs, PowerShell logs, and EDR alerts for unusual local process execution by non-administrative users, unexpected access to sensitive processes or protected system areas, abnormal handle access patterns, credential-access behavior, and follow-on reconnaissance. Useful log sources include Windows Security events for process creation if enabled, Sysmon Event ID 1 for process creation, Sysmon Event ID 10 for process access, Sysmon Event ID 7 for image loads, PowerShell Script Block Logging Event ID 4104, and EDR telemetry for suspicious kernel or security-feature bypass behavior. Pay particular attention to activity from low-privileged users on servers, administrator workstations, jump hosts, and systems that later show credential dumping, lateral movement, or privilege escalation attempts. Since no known exploit maturity or threat actors are reported, detection should be behavior-based rather than signature-based.

• Windows Security Event ID 4688
• Sysmon Event ID 1
• Sysmon Event ID 10
• Sysmon Event ID 7
• PowerShell Event ID 4104
• SeDebugPrivilege
• lsass.exe
• comsvcs.dll MiniDump
• rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump
• procdump.exe -ma lsass.exe
• sekurlsa::logonpasswords
• mimikatz.exe

What your security team should do

• Track this vulnerability in the monthly Windows patch cycle and deploy the applicable Microsoft cumulative updates to all affected Windows client and server versions.
• Prioritize remediation for domain controllers, administrator workstations, jump servers, VDI/session hosts, file servers, and systems used by multiple interactive users.
• Use endpoint management tooling to produce compliance reporting by Windows version and patch level, and follow up on systems missing the relevant cumulative update.
• Harden local access by removing unnecessary local administrators, limiting interactive logon rights, and enforcing least privilege.
• Ensure endpoint detection and response is enabled on affected systems and captures process creation, command line, module load, and security event telemetry.
• Monitor for suspicious post-compromise behavior because this vulnerability requires local authenticated access and is most likely used after an initial foothold.
• Apply compensating controls such as Microsoft Defender Credential Guard, LSASS protection where compatible, attack surface reduction rules, and application control on high-value systems.
• Reassess urgency if public exploit code, in-the-wild exploitation, KEV listing, or ransomware usage is later reported.