What is the CVSS score of CVE-2026-27910?

CVE-2026-27910 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Microsoft are affected by CVE-2026-27910?

CVE-2026-27910 is a Windows Installer privilege escalation affecting Windows 10, 11, and Server 2012-2025 that allows authenticated local users to gain SYSTEM-level access, potentially compromising…. A patch is available.

How to fix or mitigate CVE-2026-27910?

Within 24 hours: Inventory all affected Windows 10, 11, and Server 2012-2025 systems and prioritize patching for systems with multiple local user accounts or contractor access. Within 7 days: Deploy vendor-released patches across all affected platforms; verify patch application through WSUS or endpoint management tools. Within 30 days: Complete full remediation across the organization and validate patch compliance via automated scanning.

Microsoft CVE-2026-27910

EUVD-2026-22449 HIGH

Improper Handling of Insufficient Permissions or Privileges (CWE-280)

2026-04-14 microsoft

GHSA-3wgf-ccpx-rv72

Information Disclosure Microsoft

7.8

CVSS 3.1 · NVD

Temporal: 6.8

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

CIRCL (temporal)

6.8 MEDIUM

cvss

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 15:22 vuln.today

cvss_changed

Analysis Generated

Apr 14, 2026 - 19:28 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 17:46 euvd

EUVD-2026-22449

Analysis Generated

Apr 14, 2026 - 17:46 vuln.today

Patch released

Apr 14, 2026 - 17:46 nvd

Patch available

CVE Published

Apr 14, 2026 - 16:58 nvd

HIGH 7.8

DescriptionCVE.org

Improper handling of insufficient permissions or privileges in Windows Installer allows an authorized attacker to elevate privileges locally.

AnalysisAI

Windows Installer privilege escalation via improper permission handling enables authenticated local users to gain SYSTEM-level access across all supported Windows 10, 11, and Server platforms (2012-2025). The vulnerability (CWE-280: Improper Handling of Insufficient Privileges) requires low-privilege local access but offers complete system compromise with low attack complexity. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Obtain local user account

Exploit

Execute malicious Windows Installer package

Execution

Exploit privilege escalation flaw

Impact

Gain SYSTEM-level access

Access

Obtain local user account

Exploit

Execute malicious Windows Installer package

Execution

Exploit privilege escalation flaw

Impact

Gain SYSTEM-level access

Vulnerability AssessmentAI

Exploitation	Local user account required on Windows system with Windows Installer service running. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	Real-world risk is HIGH for multi-user environments and standard deployment scenarios. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An authenticated local user crafts a malicious .msi package that exploits improper permission validation in Windows Installer, escalating privileges to SYSTEM without requiring administrative credentials or user interaction.
Remediation	Apply Microsoft security updates immediately through Windows Update, WSUS, or Configuration Manager to upgrade to patched versions. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Inventory all affected Windows 10, 11, and Server 2012-2025 systems and prioritize patching for systems with multiple local user accounts or contractor access. …

Threat intelligence, references, and detailed analysis are available after sign-in.