What is the CVSS score of CVE-2026-48581?

CVE-2026-48581 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Microsoft Surface are affected by CVE-2026-48581?

Microsoft Surface devices (Go, Hub, Laptop, Pro, and Dev Kit) are vulnerable to local privilege escalation through firmware access control flaws that allow authenticated users to gain full system…. A patch is available.

How to fix or mitigate CVE-2026-48581?

Within 24 hours, use your MDM and asset inventory systems to identify all Microsoft Surface devices across your organization and establish patch deployment scope. Within 7 days, deploy Microsoft's security patch through Windows Update or direct MSRC download to all affected Surface models, prioritizing mission-critical and high-touch systems first. Complete organization-wide deployment and validation within 30 days using MDM reporting to confirm 100% patch coverage; configure MDM compliance policies to enforce automatic updates for future Surface firmware patches.

Microsoft Surface CVE-2026-48581

EUVD-2026-43794 HIGH

Insufficient Granularity of Access Control (CWE-1220)

2026-07-14 microsoft

GHSA-59xf-77x2-pv8f

Microsoft Information Disclosure Microsoft Surface Go Microsoft Surface Hub Microsoft Surface Laptop Go Microsoft Surface Laptop Go 3 Microsoft Surface Pro Microsoft Surface Pro 8 Surface Laptop 4 With Amd Processor Surface Laptop 4 With Intel Processor Surface Windows Dev Kit

7.8

CVSS 3.1 · Vendor: microsoft

Temporal: 6.8

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CIRCL (temporal)

6.8 MEDIUM

cvss

vuln.today AI

7.8 HIGH

Local vector and a valid low-privileged account are required (AV:L, PR:L) with no user interaction; successful escalation yields full C/I/A impact within an unchanged scope.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 18:38 vuln.today

CVE Published

Jul 14, 2026 - 17:05 cve.org

HIGH 7.8

DescriptionCVE.org

Insufficient granularity of access control in Microsoft Surface allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in Microsoft Surface devices (Go, Hub, Laptop Go/Go 3, Pro/Pro 8, Laptop 4 AMD/Intel, Windows Dev Kit) allows an authenticated low-privileged user to gain higher privileges through insufficiently granular access control (CWE-1220) in the device firmware/platform layer. The flaw carries a CVSS 7.8 (High) with full confidentiality, integrity, and availability impact once exploited, but requires prior local access. No public exploit identified at time of analysis, and it is not listed in CISA KEV; Microsoft has released a fix via MSRC.

Technical ContextAI

The root cause is CWE-1220, 'Insufficient Granularity of Access Control,' meaning the access-control mechanism in the affected Surface platform (typically firmware, UEFI, or a Surface-specific system component/driver) does not enforce sufficiently fine-grained separation between privilege boundaries, permitting a subject with limited rights to reach resources or operations that should be restricted to higher-privileged contexts. The CPE data scopes this to Microsoft Surface hardware product lines rather than a general Windows OS component: Surface Go, Surface Hub, Surface Laptop Go and Laptop Go 3, Surface Pro and Pro 8, Surface Laptop 4 (AMD and Intel variants), and the Surface Windows Dev Kit. Because these are device-firmware/platform components delivered through Surface driver/firmware update packages, remediation is device-model specific rather than a single OS patch. The 'Information Disclosure' tag alongside the elevation-of-privilege classification suggests the weak access boundary can also expose data across trust levels.

RemediationAI

Patch available per vendor advisory - apply the Microsoft Surface firmware/driver update addressing CVE-2026-48581 as published on the MSRC update guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48581); because fixes for Surface are delivered as model-specific firmware/driver packages via Windows Update and the Surface driver-and-firmware download packs, update each affected model (Surface Go, Hub, Laptop Go/Go 3, Pro/Pro 8, Laptop 4 AMD/Intel, Windows Dev Kit) to the current package. The input does not provide an exact fixed version number, so verify the patched firmware/driver build against the MSRC guide before deployment. Until patched, reduce exposure by limiting local interactive and administrative access to these devices, enforcing least-privilege for standard users, applying full-disk encryption (BitLocker) and boot/firmware protections to raise the bar for local attackers, and monitoring for unexpected privilege changes; note that restricting local logon rights limits legitimate device usability and does not fully remove the underlying weakness.