What is the CVSS score of CVE-2026-45487?

CVE-2026-45487 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Microsoft Windows are affected by CVE-2026-45487?

Windows Program Compatibility Assistant Service contains a local privilege escalation vulnerability affecting Windows 10, 11, and Server 2022/2025 systems, permitting authenticated users to escalate…. A patch is available.

How to fix or mitigate CVE-2026-45487?

Within 24 hours: Identify and catalog all Windows 10, 11, Server 2022, and Server 2025 systems in your environment using endpoint detection and response (EDR) or patch management tools. Within 7 days: Deploy available Microsoft patches for CVE-2026-45487 across all affected systems, prioritizing server infrastructure and workstations for users with administrative responsibilities. Within 30 days: Complete enterprise-wide patch deployment and validate remediation status through automated vulnerability scanning.

Microsoft Windows CVE-2026-45487

EUVD-2026-35673 HIGH

Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)

2026-06-09 secure@microsoft.com

GHSA-fj7f-jv57-m7jh

Information Disclosure

7.0

CVSS 3.1 · NVD

Temporal: 6.8

Severity by source

NVD PRIMARY

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CIRCL (temporal)

6.8 MEDIUM

cvss

vuln.today AI

7.0 HIGH

Local code execution as a standard user is required (AV:L, PR:L), winning a TOCTOU race is non-deterministic (AC:H), no user interaction, and SYSTEM-level escalation yields full C/I/A impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jun 11, 2026 - 15:43 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 11, 2026 - 15:42 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 11, 2026 - 15:37 vuln.today

cvss_changed

CVSS changed

Jun 11, 2026 - 15:37 NVD

7.8 (HIGH) 7.0 (HIGH)

Patch available

Jun 09, 2026 - 19:03 EUVD

Analysis Generated

Jun 09, 2026 - 18:18 vuln.today

DescriptionNVD

Time-of-check time-of-use (TOCTOU) race condition in Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in the Windows Program Compatibility Assistant (PCA) Service affects supported Windows 10, Windows 11, and Windows Server 2022/2025 builds through a TOCTOU race condition (CWE-367). An authenticated local attacker who wins the race window can elevate from a standard user context to higher privileges with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and EPSS is very low (0.05%), but Microsoft has released patches across all affected branches.

Technical ContextAI

The Program Compatibility Assistant (PCA) Service is a Windows component (pcasvc.dll) that monitors program execution to detect and apply compatibility shims for legacy applications, and it runs with elevated privileges. CWE-367 (Time-of-check Time-of-use) describes a class of race conditions where the state of a resource (such as a file path, handle, or registry key) is validated and then operated on as two non-atomic steps, allowing a concurrent attacker to swap the underlying resource between the check and the use. The affected CPEs cover Windows 10 21H2/22H2, Windows 11 23H2/24H2 (and the 25H2/26H1 builds in the EUVD list), and Windows Server 2022/2025 across x86, x64, and arm64, indicating the vulnerable code path is in a shared servicing component rather than an edition-specific feature.

RemediationAI

Apply the cumulative Windows security update for your branch that brings the OS to at least the fixed build listed in the MSRC advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45487): Windows 10 21H2/22H2 to 19044.7417/19045.7417, Windows 11 23H2 to 22631.7219, Windows 11 24H2 and 25H2 to 26100.8655/26200.8655, Windows 11 26H1 to 28000.2269, Windows Server 2022 to 20348.5256, and Windows Server 2025 (including Server Core) to 26100.32995 - vendor-released patch confirmed in those builds. As a temporary compensating control where patching is blocked, the Program Compatibility Assistant Service (PcaSvc) can be disabled or set to Manual via services.msc or 'sc config PcaSvc start= disabled', with the side effect that Windows will no longer detect and apply compatibility shims to legacy applications and the PCA UI prompts will not appear, which may break older line-of-business software. Additionally restrict interactive logon on multi-user systems and tighten application allow-listing (WDAC/AppLocker) so that the unprivileged code needed to enter the race window cannot easily be executed.