Privilege escalation in the Windows Bluetooth Service allows a low-privileged local attacker to gain SYSTEM-level access by exploiting a race condition in shared resource handling. Affected versions span Windows 10 21H2/22H2, Windows 11 23H2 through 26H1, Windows Server 2022, and Windows Server 2025. Microsoft has released patched builds; no public exploit has been identified at time of analysis.
Local privilege escalation in Windows Installer (msiexec) allows a low-privileged authenticated user to gain full SYSTEM-level control by exploiting a race condition on a shared resource during installer operations. The vulnerability is present across a broad swath of Windows desktop and server releases, from Windows Server 2012 through Windows Server 2025 and Windows 11 26H1. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the CVSS High score (7.0) and full C:H/I:H/A:H impact reflect the severity of a successful escalation.
Privilege escalation in the Windows MIDI Service Module on Windows 11 enables a low-privileged local attacker to gain full system control by exploiting a time-of-check time-of-use (TOCTOU) race condition (CWE-367). Affected builds span all three actively supported Windows 11 release tracks - 24H2, 25H2, and 26H1 - and Microsoft has released patches for each. No public exploit code or CISA KEV listing has been identified at time of analysis, so exploitation at scale is not currently confirmed.
Use-after-free in the Windows Win32K kernel subsystem allows a locally authenticated attacker to escalate privileges to SYSTEM on affected Windows 10 and Windows Server 2012 through 2019 systems. Microsoft has released patches via MSRC addressing builds across all listed version ranges, including Server 2012, 2012 R2, 2016, 2019, and Windows 10 1607 and 1809. No public exploit code or CISA KEV listing has been identified at time of analysis; the AC:H metric indicates exploitation requires precise heap manipulation or race condition timing.
Local privilege escalation in the Windows TCP/IP stack exploits a race condition (CWE-362) to allow a low-privileged local user to gain full system-level control across virtually every supported Windows release. The vulnerability spans Windows 10 through Windows 11 25H2 and Windows Server 2012 through Server 2025, making the breadth of exposure exceptionally wide. Microsoft has released patches; no public exploit or CISA KEV listing was identified at time of analysis, but the scope of affected systems elevates organizational urgency.
Local privilege escalation in the Windows Audio Video Control Transport Protocol (AVCTP) Bluetooth stack allows a low-privileged authenticated user to gain SYSTEM-level access on affected Windows 11 and Windows Server 2025 systems. The root cause is a use-after-free (CWE-416) in the AVCTP driver, where freed memory is subsequently accessed, enabling controlled memory corruption. No public exploit or CISA KEV listing exists at time of analysis; however, the full C:H/I:H/A:H impact and widespread Windows deployment make this a meaningful patching priority for endpoint and server administrators.
Privilege escalation in the Windows Bluetooth Service enables a locally authenticated low-privileged user to gain SYSTEM-level access across a wide range of Windows 10, Windows 11, and Windows Server versions. The root cause is a race condition (CWE-362) in shared resource handling within the Bluetooth service, where competing threads can exploit an unsynchronized access window to trigger a privileged operation in the attacker's context. Microsoft has released patches for all affected versions; no public exploit code or CISA KEV listing exists at time of analysis.
Heap-based buffer overflow in Windows Audio Service (CWE-122) enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM-level on affected Windows endpoints and servers. The vulnerability spans an exceptionally wide product range - from Windows Server 2012 to Windows 11 25H2 and Server 2025 - making coordinated patch deployment a significant operational effort across enterprise environments. No public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis; Microsoft has released patches for all affected branches.
Privilege escalation in Windows Bluetooth Service via a use-after-free (CWE-416) allows a low-privileged local user to achieve full system compromise across a broad range of Windows 10, Windows 11, and Windows Server releases. The CVSS vector (AV:L/AC:H/PR:L) indicates the flaw requires local access and elevated attack complexity - consistent with a race condition in Bluetooth service memory management - but yields full confidentiality, integrity, and availability impact upon successful exploitation. No public exploit code has been identified at time of analysis, and Microsoft has released patches via its regular update channel.
Local privilege escalation in the Windows TCP/IP kernel driver affects virtually every supported Windows release, from Server 2012 through Windows 11 26H1. A low-privileged local attacker exploits a race condition (CWE-362) in a shared TCP/IP resource accessed concurrently without proper synchronization, winning the timing window to corrupt kernel state and elevate to SYSTEM. No public exploit or CISA KEV listing exists at time of analysis, but the breadth of affected platforms - 19 distinct Windows versions including all current Server SKUs - makes prompt patching essential, particularly on multi-user and shared-access systems.
Privilege escalation in Windows Shell allows a locally authenticated attacker with standard user rights to gain full system-level control via external control of a file name or path (CWE-73). Affected platforms span Windows 11 versions 23H2 through 26H1 and Windows Server 2025, all prior to their respective July 2026 patch-cycle builds. Microsoft has released patches via Windows Update; no public exploit code or CISA KEV listing exists at time of analysis, though the C:H/I:H/A:H impact profile makes this a priority for environments where post-initial-access escalation is a concern.
Local privilege escalation in Windows Error Reporting (WER) exploits a use-after-free condition (CWE-416), enabling an authenticated low-privileged attacker to gain SYSTEM-level access on affected Windows systems. The flaw spans a wide range of platforms from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. Microsoft has released patches; no public exploit or CISA KEV listing is present at time of analysis, though the high attack complexity (AC:H) suggests a race condition or timing-dependent exploitation path.
Local privilege escalation in Windows Image Acquisition (WIA) allows an attacker with a low-privilege local account to gain SYSTEM-level access via a use-after-free memory corruption bug. The vulnerability spans nearly every supported Windows release from Server 2012 through Windows 11 26H2, making it a broadly applicable LPE primitive for post-exploitation chains. No public exploit or active exploitation has been identified at time of analysis; Microsoft has released patches through standard monthly update guidance.
Local privilege escalation in Windows Win32K (the kernel-mode graphics subsystem) allows a low-privileged authenticated user to gain SYSTEM-level access by triggering a use-after-free condition. Affected across a wide span of Windows desktop and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. No public exploit code has been identified at time of analysis, and the high attack complexity rating (AC:H) in the CVSS vector suggests reliable exploitation requires precise memory timing or race-condition manipulation.
Use-after-free in the Windows Remote Access Connection Manager (RASMAN) service enables a locally authenticated attacker to escalate privileges to SYSTEM or equivalent. The flaw affects a wide range of Windows releases from Server 2012 R2 through the current Windows 11 25H2 and Windows Server 2025 builds. Microsoft has issued patches via the standard cumulative update channel; no public exploit or CISA KEV listing is present at time of analysis, though the broad attack surface and AC:H race-condition nature make this a meaningful LPE risk in enterprise environments.
Privilege escalation to SYSTEM via use-after-free in the Windows Audio Service affects a broad range of Windows 10, 11, and Windows Server versions from 2012 R2 through 2025. An authenticated local attacker can exploit a memory management flaw in the Audio Service to free an object while a reference to it remains live, then redirect execution to gain full C:H/I:H/A:H impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the wide product footprint and low privilege requirement make this a meaningful patching priority.
Local privilege escalation in Windows Print Spooler Components (spoolsv.exe) allows an authenticated low-privilege local attacker to achieve full system compromise via a double-free memory corruption flaw. The CVSS vector (AV:L/AC:H/PR:L) indicates exploitation requires local access with low privileges but involves high attack complexity, consistent with a race condition or precise heap-shaping requirement typical of CWE-415 primitives. No public exploit or CISA KEV listing has been identified at time of analysis, though the Print Spooler service has historically been a high-value escalation target (PrintNightmare lineage).
Local privilege escalation in Windows Push Notifications (WPN) exploits a use-after-free (CWE-416) to allow a low-privileged authenticated attacker to achieve full system compromise - confidentiality, integrity, and availability all rated High. The flaw spans Windows 11 (23H2 through 26H1) and Windows Server 2022/2025, with Microsoft confirming patch availability via the MSRC update guide. CVSS AC:H reflects a race-condition timing requirement that raises the exploitation bar above trivial one-shot attacks.
Privilege escalation in the Windows Remote Desktop Gateway Service allows a low-privileged authorized attacker to achieve full system compromise via a double-free memory corruption flaw (CWE-415). Affected systems span Windows Server 2012 through 2025 and select Windows 10 builds where the RD Gateway role is installed. Microsoft has released patches across all affected versions; no public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation in Windows Push Notifications affects a broad range of Windows 10, Windows 11, and Windows Server releases. An authorized local attacker exploits a use-after-free (CWE-416) memory corruption condition to gain full system-level privileges, achieving high confidentiality, integrity, and availability impact within the vulnerable system. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis; Microsoft has released patches across all affected build lines.
Local privilege escalation in the Windows Cloud Files Mini Filter Driver (cldflt.sys) allows a low-privileged, authenticated attacker to achieve full SYSTEM-level compromise across Windows 10, Windows 11, and Windows Server 2019 through 2025. The flaw is a use-after-free (CWE-416) in the kernel-mode filter driver that underpins Windows cloud storage integration (OneDrive and compatible providers), where freed memory is reused in a way that allows an attacker to corrupt kernel objects and redirect execution. Microsoft has released patches across the affected product lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in the Windows Kernel Streaming WOW Thunk Service Driver allows a low-privileged authenticated local attacker to gain SYSTEM-level access across a broad swath of Windows versions spanning Windows 10 through Windows 11 26H1 and Windows Server 2012 through 2025. The vulnerability stems from a use-after-free (CWE-416) condition, a memory safety flaw in the WOW (Windows-on-Windows) 32-to-64-bit thunk layer used by the kernel audio/multimedia streaming subsystem. Microsoft has released patches across all affected product lines; no public exploit or CISA KEV listing has been identified at time of analysis.
Cross-site request forgery in WatchGuard Dimension's database snapshot creation endpoint allows a remote unauthenticated attacker to trigger unauthorized snapshot operations by luring an authenticated Dimension administrator to visit a malicious web page. The primary risk is availability degradation: repeated forced snapshot creation can exhaust storage or impose significant I/O load on the Dimension appliance (VA:H per CVSS 4.0). No public exploit code has been identified at time of analysis, and it is not listed in CISA KEV.
Server-side request forgery in opengeos GeoLibre up to version 2.3.0 allows malicious plugins or attacker-controlled WebView content to invoke the application's native Tauri IPC commands (`fetch_url_bytes`, `resolve_url_redirect`) to issue HTTP requests from the desktop process's privileged network position, bypassing browser CORS restrictions and potentially reaching cloud instance-metadata services (169.254.169.254) inaccessible to ordinary browser fetch. The vulnerability is fixed in GeoLibre 2.4.0 via commit b745f62e29fa37364686525a21eee5e5c0f8a369. No public exploit code is identified at time of analysis and no CISA KEV active-exploitation listing exists.
Broken or risky cryptographic algorithm usage (CWE-327) in Microsoft Exchange Server 2016 and 2019 enables unauthenticated remote attackers to intercept and disclose sensitive communications over the network. Affected builds span Exchange Server 2016 CU23, Exchange Server 2019 CU14 and CU15, and the Subscription Edition, all prior to their respective patched cumulative update versions. Microsoft has released corrective cumulative updates; no active exploitation or public proof-of-concept has been identified at time of analysis.
Improper authorization in seakee CPA-Manager-Plus 1.11.0-1.11.10 allows unauthenticated remote attackers to have GET and HEAD requests forwarded to the backend CPA service using the application's saved management key, granting read-level access to resources that should require admin credentials. The flaw resides in the CPAResource HTTP proxy handler (`apps/manager-server/internal/http/controller/proxy/handler.go`), where `useSavedManagementKey` was hardcoded to `true` for all read-method requests without invoking `AdminAuthService.VerifyHeader`, a check that was only performed for mutating methods. No public exploit code has been identified at time of analysis, and the vendor-released patch in v1.11.11 resolves the issue.
Side-channel route enumeration in Maravel PHP framework (versions prior to 10.73.1) allows unauthenticated remote attackers to map internal API route structures and controller parameter schemas by exploiting a differential HTTP response. The router's static route checklist incorrectly stores raw dynamic placeholder strings (e.g., `{id}`), so passing literal brace syntax in a request URL bypasses the dynamic tree engine, triggers a PHP 8+ `ArgumentCountError`, and returns a 500 Internal Server Error rather than the expected 404. An adversary can systematically fuzz endpoints with template-syntax paths, distinguish 500 from 404 responses, and reconstruct the application's routing schema without any authentication. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Unstripped debug symbols in Siemens Reyrolle 7SR5 protection relay firmware (all versions prior to V2.70) expose internal function names, type definitions, and structure layouts to any party who downloads the publicly available firmware update packages. This does not directly compromise deployed devices but substantially reduces the skill and effort required for an attacker to identify exploitable weaknesses through static firmware analysis. No public exploit or active exploitation has been identified; Siemens has released firmware V2.70 as the fix per advisory SSA-142885.
Authentication bypass in the Apache Airflow FAB provider (apache-airflow-providers-fab 3.7.3 through 3.8.0) lets any unauthenticated attacker log into the Airflow UI when the FAB auth manager is configured with Azure AD as an OAuth provider. Because the provider validates the id_token signature against Microsoft's multi-tenant JWKS endpoint but never checks the token's issuer or audience, an id_token minted in any Azure tenant - including one the attacker registers themselves - passes verification, and the username and role assignments are then taken from that attacker-controlled token. This is an incomplete-fix follow-up to CVE-2026-59243; operators who applied that earlier fix remain vulnerable. Publicly available exploit code exists is not indicated, but the upstream fix (PR#71735) and mechanism are public; no active exploitation is reported.
Privilege escalation in Windows DHCP Server allows an already-authorized (high-privilege) network attacker to gain further elevated privileges by exploiting a missing authentication check on a critical server function (CWE-306). The vulnerability spans nearly every supported Windows Server release from 2012 through 2025, as well as Windows 10 1607/1809. No public exploit code has been identified at time of analysis, and Microsoft has issued patches across all affected builds.
Unauthenticated information disclosure in TP-Link Omada Controller exposes an initialization API endpoint that remains reachable after setup completes, leaking account-related data to any remote unauthenticated user. The endpoint was designed for one-time use during initial controller configuration but lacks post-initialization access controls, allowing attackers to query it freely. Successful exploitation facilitates user enumeration, which can serve as a reconnaissance step toward credential-stuffing or targeted brute-force attacks against administrative accounts. No public exploit or CISA KEV listing is identified at time of analysis.
Microsoft Teams for Android before build 1416/1.0.0.2026133602 inserts sensitive information into outbound network transmissions (CWE-201), enabling a low-privileged authenticated attacker to intercept and read confidential data over the network when a victim user performs an in-app action. The CVSS scope change (S:C) with high confidentiality impact (C:H) signals that the leaked data can cross trust boundaries beyond the attacker's own session, potentially exposing other users' or sessions' sensitive material. No public exploit identified at time of analysis; Microsoft has released a patch via the MSRC advisory.
Privilege escalation via untrusted pointer dereference in the Windows SCSI Class System File affects a broad range of Windows 10, 11, and Windows Server releases, requiring physical access to trigger. An attacker with physical access to a target machine can connect a malicious SCSI device, causing the kernel-mode SCSI class driver to dereference an attacker-controlled pointer and elevate from unprivileged to full system (kernel) control. No public exploit and no CISA KEV listing have been identified at time of analysis; exploitation is constrained to physical proximity.
Heap-based buffer overflow in Windows Spaceport.sys, the kernel-mode Storage Spaces port driver, enables an unauthenticated attacker with physical access to execute arbitrary code at kernel privilege level. The vulnerability spans virtually all supported Windows client and server releases, from Windows Server 2012 through Windows Server 2025 and Windows 11 26H1/25H2. No public exploit has been identified at time of analysis; a vendor-released patch is available via the Microsoft Update Catalog.
Heap-based buffer overflow in the Windows Storage Spaces kernel driver (Spaceport.sys) enables kernel-mode code execution through a physical attack, affecting nearly every supported Windows desktop and server release. The flaw carries a CVSS 3.1 score of 6.8 with a physical attack vector, meaning an adversary must have hands-on access to the target hardware to trigger the overflow. Microsoft has issued patches covering Windows Server 2012 through Windows Server 2025 and Windows 10 through Windows 11 26H2; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Spaceport.sys, the kernel-mode Storage Spaces port driver, allows an attacker with physical access to execute arbitrary code at kernel privilege across a wide range of Windows 10, Windows 11, and Windows Server releases. The vulnerability (CWE-122) results in full confidentiality, integrity, and availability compromise of the affected system upon successful exploitation. Microsoft has released patches; no public exploit has been identified at time of analysis and CISA KEV listing is absent.
Heap-based buffer overflow in the Windows NTFS kernel driver enables an unauthenticated attacker with physical device access to execute arbitrary code at kernel privilege level. Affected products span virtually the entire supported Windows ecosystem from Server 2012 through Windows Server 2025 and Windows 11 26H1. Microsoft has released patched builds across all affected versions; no active exploitation has been identified (not in CISA KEV) and no public proof-of-concept exploit is known at time of analysis.
Privilege escalation via out-of-bounds read in the Windows USB Mass Storage Class Driver affects virtually every supported Windows release, from Server 2012 through Windows 11 26H1. An attacker with physical access to the target machine can connect a specially crafted USB storage device to trigger the kernel-mode memory flaw, potentially achieving complete system compromise (C:H/I:H/A:H per CVSS). No public exploit has been identified at time of analysis, and Microsoft has released patches covering all affected version branches.
Heap-based buffer overflow in the Windows NTFS kernel driver allows an unauthenticated attacker with physical access to execute arbitrary code at kernel privilege on affected systems. The vulnerability spans nearly every supported Windows release from Server 2012 through Windows 11 26H1 and Windows Server 2025, and is triggered when the NTFS driver processes a specially crafted volume attached by an adversary. No public exploit code has been identified at time of analysis, and Microsoft has released patches through its standard update channel.
Privilege escalation in Windows Boot Manager allows an unauthorized attacker with physical access to achieve full pre-OS system compromise, yielding high confidentiality, integrity, and availability impact across a sweeping range of Windows desktop and server editions. The root cause is a protection mechanism failure (CWE-693) in the boot-time security stack - consistent with a Secure Boot or early-launch integrity bypass - that an adversary can exploit without any prior authentication or system privileges once physical access is obtained. Microsoft has released patches for all affected versions; no public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Privilege escalation via physical USB attack affects the Windows USB Hub Driver across a wide range of Windows 10, Windows 11, and Windows Server releases. An out-of-bounds read (CWE-125) in the kernel-mode USB Hub Driver can be triggered by an attacker who plugs a crafted USB device into an exposed port, ultimately enabling full system compromise (C:H/I:H/A:H). No authentication or user interaction is required beyond physical proximity; the attack is constrained solely by the requirement of physical access to the target machine. No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected Windows versions.
Heap-based buffer overflow in the Windows NTFS kernel driver enables an unauthenticated attacker with physical access to execute arbitrary code at kernel privilege level. The vulnerability (CWE-122) affects virtually the entire Windows product family from Server 2012 through Windows 11 26H1 and Windows Server 2025, requiring no credentials or user interaction beyond physical presence at the target machine. No public exploit or active exploitation has been identified at time of analysis; Microsoft has released patches across all affected version branches.
LDAP injection in Okta Access Gateway versions before 2026.9.1 allows a network-authenticated attacker to manipulate LDAP search filter logic by supplying crafted SAML assertion attribute values. Because the Access Gateway interpolates raw SAML attribute values directly into LDAP filter strings without sanitization, an attacker controlling those values can inject LDAP metacharacters to rewrite the intended query - potentially bypassing authorization decisions or extracting sensitive directory entries. No public exploit is identified at time of analysis, but the vendor has released a fix in 2026.9.1.
Path traversal in the gnome-tweaks shell theme installer allows a local attacker who can persuade a user to install a crafted ZIP-packaged theme to write arbitrary files outside the intended ~/.themes directory. The flaw - a classic "zip slip" pattern (CWE-22) - exploits the absence of archive-member-path validation: malicious archives can embed ../ sequences, absolute paths, or symlink entries to redirect file writes anywhere the victim user can write. With user-level write access this can overwrite shell startup scripts, SSH authorized_keys, or desktop autostart entries, escalating to persistent code execution under the victim's account. No public exploit code or KEV listing exists at time of analysis; EPSS data was not provided.
Privilege escalation to SYSTEM level is achievable in Windows Volume Shadow Copy Service (VSS) across a broad range of Microsoft Windows and Windows Server releases, from Server 2012 through Windows 11 25H2 and Server 2025. The root cause is a heap-based buffer overflow (CWE-122) exploitable by an unauthenticated attacker with physical access to the target machine, yielding full C:H/I:H/A:H impact. SSVC assessment confirms no current exploitation and a non-automatable attack path; no public exploit identified at time of analysis.
Privilege escalation via relative path traversal (CWE-23) affects the Windows DNS Server service across a broad range of Windows Server releases from 2012 through 2025. An authorized local attacker holding high-privilege access can manipulate relative path sequences in the DNS service to reference files or system resources outside the intended directory scope, resulting in full Confidentiality, Integrity, and Availability impact through SYSTEM-level privilege escalation. Microsoft has released patches across all affected builds; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Installer (msiexec) enables local privilege escalation across a broad range of Microsoft Windows client and server releases. An attacker with high-privileged local access can exploit this CWE-122 flaw to achieve full system-level code execution - compromising confidentiality, integrity, and availability - making it a post-exploitation escalation primitive. Vendor-released patches are available; no public exploit code or CISA KEV listing is identified at time of analysis.
Heap-based buffer overflow in Windows Hello allows an attacker who already holds elevated local access to escalate privileges beyond the Windows Hello security boundary, achieving high confidentiality, integrity, and availability impact across the broader Windows system. Affected builds span Windows 10 21H2/22H2 and Windows 11 23H2 through 26H1, representing virtually all currently supported Windows feature releases. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patched builds via Patch Tuesday.
PHP code injection in Okta Access Gateway (all versions prior to 2026.9.1) allows an authenticated administrator to execute arbitrary code as the web server process by embedding malicious PHP payloads in dashboard application label values. The gateway writes these labels unsanitized into generated PHP configuration files, which are automatically included on every subsequent authentication request, triggering execution without further interaction. No public exploit has been identified at time of analysis; vendor-released patch is available at version 2026.9.1.
OS command injection in Okta Access Gateway (versions prior to 2026.9.1) allows an authenticated high-privileged local user to inject shell metacharacters into SNMP configuration values, causing a privileged backend script to execute arbitrary OS commands as root. The vulnerability (CWE-78) stems from failure to sanitize user-supplied configuration data before incorporating it into OS command construction. No public exploit or active exploitation has been identified; a vendor-released patch is available.