EUVD-2026-35576
GHSA-gv67-34rh-v566
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local access
-
DeliveryLocate Hotpatch Monitoring Service interface
-
ExploitSend crafted input triggering out-of-bounds write
-
ExecutionCorrupt service memory to hijack execution
-
PersistExecute code as SYSTEM
-
ImpactEstablish persistence and move laterally
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must already have local execution on a Windows host with the Hotpatch Monitoring Service running, holding at least a low-privileged authenticated account (PR:L). The target system must specifically have Hotpatch enabled - this is not a default configuration on all Windows installations and is most commonly seen on Windows Server Azure Edition and Azure VMs opted into Hotpatch update rings, which meaningfully limits the exposed population. No user interaction is required (UI:N), the attack complexity is low (AC:L), and the attack is not exploitable over the network (AV:L), so remote-only attackers cannot reach this vulnerability without first obtaining a local foothold. |
| Impact | Risk signals are mixed but lean toward 'patch promptly, not emergency.' The CVSS vector (AV:L/AC:L/PR:L/UI:N) indicates the attacker must already have local code execution with at least low privileges, which significantly narrows real-world exploitation to post-compromise scenarios - making this a second-stage tool for ransomware operators or initial-access brokers rather than a perimeter risk. The C:H/I:H/A:H impact reflects full SYSTEM-level compromise upon successful exploitation. EPSS data was not provided in the input, KEV status is not confirmed, and no public exploit is identified at time of analysis - so prioritization should be driven by exposure (multi-tenant Windows Server hosts, Azure VMs using Hotpatch) rather than imminent mass exploitation. Notably, only the MSRC advisory reference is provided; no third-party analysis, POC, or CISA KEV listing is in the source data, so confidence in 'no in-the-wild use' is bounded by the limited intelligence available. |
| Exploit ScenarioDerived | An attacker who has already obtained low-privileged local access - for example, via phishing-delivered malware, a compromised RDP account, or a web-application foothold on a Windows Server - interacts with the Hotpatch Monitoring Service in a way that triggers the out-of-bounds write, corrupting service memory to hijack execution as SYSTEM. The result is a full local privilege escalation, enabling lateral movement, credential harvesting, and persistence. No public exploit identified at time of analysis, but the CWE-787 class is well-understood and historically exploitable once vulnerable code paths are reverse-engineered from the patch diff. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 09, 2026
Local privilege escalation in the Windows Hotpatch Monitoring Service enables an authenticated low-privileged attacker to gain elevated privileges through an out-of-bounds write (CWE-787) memory corruption flaw. The CVSS 7.8 (AV:L/AC:L/PR:L) reflects local attack vector with low complexity once a foothold is obtained, and no public exploit identified at time of analysis. The vulnerability was reported by Microsoft's own security team (secure@microsoft.com), suggesting internal discovery prior to disclosure.
RemediationAI
Apply the Microsoft security update referenced in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42910 as the primary remediation - patch available per vendor advisory, with exact build numbers to be retrieved from the MSRC update guide per affected Windows Server / Azure SKU. Because the attack requires local low-privileged access, defenders without an immediate patch window should harden local access controls: restrict interactive and remote PowerShell/RDP logon to Hotpatch-enabled hosts to administrators only, enforce LAPS-managed local accounts, and monitor for unexpected child processes spawned by the Hotpatch service (trade-off: tighter access controls may break automation accounts that rely on low-privilege local logon). If Hotpatch is not actively required, disabling the feature and reverting to scheduled-restart patching removes the attack surface entirely at the cost of patch-induced downtime.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 9 packages in microsoft, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Windows Hotpatch Monitoring Service is part of Microsoft's Hotpatch infrastructure that enables applying security updates to running processes without requiring a system restart, primarily used in Azure and Windows Server environments. The root cause is CWE-787 (Out-of-bounds Write), a memory safety flaw where the service writes data past the boundaries of an allocated buffer - typically corrupting adjacent memory structures such as function pointers, return addresses, or object headers. Because the Hotpatch service runs with elevated system privileges to manage kernel and user-mode patching operations, corruption of its memory space provides a direct path to privilege elevation. The 'Buffer Overflow, Memory Corruption' tags reinforce that this is a classic memory-safety defect rather than a logic flaw.
Know when Windows 11 24h2 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
DescriptionCVE.org
Out-of-bounds write in Windows Hotpatch Monitoring Service allows an authorized attacker to elevate privileges locally.
Executive ViewAI
A privilege escalation vulnerability in Windows Hotpatch Monitoring Service (CVE-2026-42910, CVSS 7.8) enables authenticated users with standard system privileges to escalate to administrator-level access. Organizations risk credential compromise leading to lateral movement across infrastructure if local user accounts are breached or controlled by insiders. No vendor patch is currently available, requiring interim protective measures.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict local logon rights via Group Policy to administrative accounts only; (2) Implement application allowlisting to restrict execution from low-privileged contexts; (3) Enable and monitor Windows Audit Policy for privilege escalation events; (4) Disable Hotpatch Monitoring Service if non-critical to operations; (5) Network segmentation to isolate affected systems; (6) Enforce multi-factor authentication for any remote administrative access.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
More in Windows 11 24h2
View allWindows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Why is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Windows MSHTML Platform Spoofing Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitab
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows Task Scheduler Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low a
Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then
Symlink following (CWE-59) in the Windows Update Stack enables a locally authenticated attacker with standard user privi
A security feature bypass in Microsoft Management Console (MMC) allows attackers to evade security warnings and execute
Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attac
Windows CLFS Driver contains an input validation flaw enabling local privilege escalation, yet another CLFS kernel vulne
Exploit-DB