Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local authenticated low-priv attacker (AV:L/PR:L), no interaction or complexity, elevating to SYSTEM yields full C/I/A impact within an unchanged scope.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Improper authorization in Windows Installer allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in Microsoft Windows Installer (msiexec/MSI service) lets an already-authenticated low-privilege user elevate to SYSTEM by abusing an improper authorization check (CWE-285). Affected platforms span Windows 10 (1607 through 22H2), Windows 11 (24H2/25H2/26H1), and Windows Server 2012 through 2025, including Server Core installations. Microsoft has released a patch; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, so risk is currently potential rather than confirmed in-the-wild exploitation.
Technical ContextAI
Windows Installer is the built-in MSI-based software installation and servicing subsystem (msiexec.exe and the Windows Installer service) present on every modern Windows client and server. Because installer operations frequently run with elevated/SYSTEM rights to write to protected locations and modify system configuration, any authorization gap in how it validates the requesting principal is a classic local elevation-of-privilege primitive. The CWE-285 (Improper Authorization) root cause means the component performs a privileged action without correctly verifying that the caller is authorized for it, allowing a standard user context to reach operations reserved for administrators or SYSTEM. The affected-product list (per Microsoft CPE data) confirms this is a core-OS component flaw rather than a third-party application, affecting Windows 10 1607/1809/21H2/22H2, Windows 11 24H2/25H2/26H1, and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 (including Server Core).
RemediationAI
Apply the Microsoft security update for CVE-2026-58540 (Patch available per vendor advisory) via Windows Update, WSUS, or your patch-management system; consult the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58540 for the exact KB and fixed build for each affected OS version, as the record does not publish a single cross-product fix version. Prioritize multi-user, shared, and jump/terminal hosts where untrusted low-privilege users have interactive access, since those maximize exposure to a local EoP. No Microsoft-endorsed workaround is provided in the available data; because exploitation requires an existing authenticated local foothold, interim compensating controls are to tighten who can log on interactively or run installer operations, restrict standard-user access on sensitive servers, and consider the Group Policy 'Always install with elevated privileges' setting is left DISABLED (its trade-off is none for security, as enabling it independently broadens installer EoP exposure) - but these reduce, not eliminate, risk and are not a substitute for the patch.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today
EUVD-2026-44291
GHSA-8h8w-xq32-r3wr