What is the CVSS score of CVE-2026-42989?

CVE-2026-42989 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Microsoft Winlogon are affected by CVE-2026-42989?

Microsoft Winlogon vulnerability (CVE-2026-42989) enables authenticated users with local system access to gain administrator-level privileges.. A patch is available.

How to fix or mitigate CVE-2026-42989?

Within 24 hours: Inventory all Windows systems and document current Winlogon patch status. Within 7 days: Deploy Microsoft's released security patch to all Windows systems, prioritizing servers and high-value workstations. Within 30 days: Confirm 100% patch deployment completion and validate remediation through automated scanning.

Microsoft Winlogon CVE-2026-42989

EUVD-2026-35742 HIGH

Improper Link Resolution Before File Access (CWE-59)

2026-06-09 secure@microsoft.com

GHSA-2m3h-x8jm-fmwh

Information Disclosure Microsoft Windows 10 1607 Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025

7.8

CVSS 3.1 · Vendor: microsoft

Temporal: 6.8

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CIRCL (temporal)

6.8 MEDIUM

cvss

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 18:45 vuln.today

DescriptionCVE.org

Improper link resolution before file access ('link following') in Winlogon allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in Microsoft Winlogon allows authenticated low-privileged users to gain elevated (SYSTEM-level) privileges by abusing improper link resolution before file access. The flaw is rooted in CWE-59 (link following) within the Windows logon component, and while no public exploit has been identified at time of analysis, the CVSS 7.8 rating reflects the high impact to confidentiality, integrity, and availability once a local attacker has a foothold. Microsoft has released a patch via the MSRC advisory.

Technical ContextAI

Winlogon (winlogon.exe) is the Windows component responsible for handling user logons, logoffs, secure attention sequence (Ctrl+Alt+Del), and loading the user profile and shell. It runs as a privileged SYSTEM process and interacts with the local filesystem during session setup. The underlying weakness is CWE-59 (Improper Link Resolution Before File Access, aka 'link following'): Winlogon performs a file operation on a path that an attacker can influence via a symbolic link, junction, or hard link, causing the privileged process to read, write, or modify a file the unprivileged attacker could not normally access. This class of bug is a well-known Windows EoP primitive frequently abused via NTFS junctions and object-manager symlinks.

RemediationAI

Apply the Microsoft-released security update referenced in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42989 through Windows Update, WSUS, or your standard patch-management pipeline; the input confirms a vendor patch is available but does not enumerate a specific KB or build number, so consult the MSRC update guide for the exact package for each Windows SKU in your fleet. Until patches are deployed, reduce local-attack exposure by tightening who can obtain interactive or RDP sessions on sensitive hosts (domain controllers, jump boxes, developer workstations) and by enabling and monitoring Sysmon/EDR detections for symbolic-link and junction creation in user-writable directories that are later accessed by SYSTEM processes - note that broadly blocking symlink creation can break legitimate developer tooling and container workloads, so apply such controls selectively. Disabling Winlogon is not a viable workaround as it is required for interactive logon.