What is the CVSS score of CVE-2026-49161?

CVE-2026-49161 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Microsoft PC Manager are affected by CVE-2026-49161?

CVE-2026-49161 in Microsoft PC Manager enables authenticated users to escalate privileges and compromise system confidentiality, integrity, and availability.. A patch is available.

How to fix or mitigate CVE-2026-49161?

Within 24 hours: Inventory all systems running Microsoft PC Manager and assess user account access patterns. Within 7 days: Implement least-privilege access controls, disable unnecessary PC Manager features, and enable privilege escalation logging and alerting. Within 30 days: Actively monitor Microsoft security advisories for CVE-2026-49161 patch availability and prepare deployment procedures; no public exploit was identified at time of analysis, but this status could change.

Microsoft PC Manager CVE-2026-49161

EUVD-2026-35528 HIGH

Improper Access Control (CWE-284)

2026-06-09 secure@microsoft.com

GHSA-25vj-c5mm-vwxg

Authentication Bypass Microsoft Pc Manager

7.8

CVSS 3.1 · Vendor: microsoft

Temporal: 6.8

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CIRCL (temporal)

6.8 MEDIUM

cvss

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 17:43 vuln.today

CVE Published

Jun 09, 2026 - 17:17 nvd

HIGH 7.8

DescriptionCVE.org

Improper access control in Microsoft PC Manager allows an authorized attacker to bypass a security feature locally.

AnalysisAI

Local privilege escalation in Microsoft PC Manager allows an authenticated low-privileged attacker to bypass a security feature on the affected system, leading to high impact on confidentiality, integrity, and availability. The flaw stems from improper access control (CWE-284) and currently has no public exploit identified at time of analysis. The CVSS 7.8 score reflects local attack vector with low complexity but requires the attacker to already have valid credentials on the target host.

Technical ContextAI

Microsoft PC Manager is a system optimization and maintenance utility for Windows that bundles cleanup, security scanning, and performance tools - typically running with elevated privileges to perform system-level changes. The underlying weakness is CWE-284 (Improper Access Control), meaning the product fails to properly enforce authorization checks on a security-relevant operation or resource. In practice this class of bug usually involves a privileged service, IPC endpoint, or protected configuration surface that does not adequately validate the caller's rights, allowing a lower-privileged caller to invoke functionality intended for higher trust levels. The advisory does not enumerate the exact component or interface, so the specific access control boundary that fails (file ACL, named pipe, COM interface, registry key, or scheduled task) is not disclosed in the available data.

RemediationAI

Apply the update referenced in Microsoft's advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49161; the available intelligence indicates a patch available per vendor advisory but does not list an exact fixed version, so administrators should consult MSRC for the current shipping build and ensure PC Manager auto-update is enabled or push the updated installer via management tooling. Where patching is not immediately feasible, compensating controls include uninstalling Microsoft PC Manager from endpoints that do not require it (eliminates the attack surface but removes the cleanup/optimization functionality users may rely on), restricting interactive logon to the affected hosts so untrusted local accounts cannot reach the vulnerable interface (reduces exposure but does not protect against malware already running as a standard user), and monitoring EDR for unexpected privilege transitions or invocations of PC Manager components from non-interactive contexts (detection only, not prevention).