Skip to main content

Severity by source

Vendor (microsoft) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local authenticated low-priv attacker (AV:L/PR:L), no interaction or complexity, elevating to SYSTEM yields full C/I/A impact within an unchanged scope.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 14, 2026 - 18:49 vuln.today
CVE Published
Jul 14, 2026 - 17:10 nvd
HIGH 7.8

DescriptionCVE.org

Improper authorization in Windows Installer allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in Microsoft Windows Installer (msiexec/MSI service) lets an already-authenticated low-privilege user elevate to SYSTEM by abusing an improper authorization check (CWE-285). Affected platforms span Windows 10 (1607 through 22H2), Windows 11 (24H2/25H2/26H1), and Windows Server 2012 through 2025, including Server Core installations. Microsoft has released a patch; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, so risk is currently potential rather than confirmed in-the-wild exploitation.

Technical ContextAI

Windows Installer is the built-in MSI-based software installation and servicing subsystem (msiexec.exe and the Windows Installer service) present on every modern Windows client and server. Because installer operations frequently run with elevated/SYSTEM rights to write to protected locations and modify system configuration, any authorization gap in how it validates the requesting principal is a classic local elevation-of-privilege primitive. The CWE-285 (Improper Authorization) root cause means the component performs a privileged action without correctly verifying that the caller is authorized for it, allowing a standard user context to reach operations reserved for administrators or SYSTEM. The affected-product list (per Microsoft CPE data) confirms this is a core-OS component flaw rather than a third-party application, affecting Windows 10 1607/1809/21H2/22H2, Windows 11 24H2/25H2/26H1, and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 (including Server Core).

RemediationAI

Apply the Microsoft security update for CVE-2026-58540 (Patch available per vendor advisory) via Windows Update, WSUS, or your patch-management system; consult the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58540 for the exact KB and fixed build for each affected OS version, as the record does not publish a single cross-product fix version. Prioritize multi-user, shared, and jump/terminal hosts where untrusted low-privilege users have interactive access, since those maximize exposure to a local EoP. No Microsoft-endorsed workaround is provided in the available data; because exploitation requires an existing authenticated local foothold, interim compensating controls are to tighten who can log on interactively or run installer operations, restrict standard-user access on sensitive servers, and consider the Group Policy 'Always install with elevated privileges' setting is left DISABLED (its trade-off is none for security, as enabling it independently broadens installer EoP exposure) - but these reduce, not eliminate, risk and are not a substitute for the patch.

CVE-2026-33824 CRITICAL POC
9.8 Apr 14

Remote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen

CVE-2026-56155 HIGH POC
7.8 Jul 14

Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p

CVE-2026-32202 MEDIUM POC
4.3 Apr 14

Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n

CVE-2026-49798 CRITICAL POC
9.3 Jul 14

Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve

CVE-2026-54128 HIGH POC
8.4 Jul 14

Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff

CVE-2026-50518 CRITICAL
9.8 Jul 14

Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr

CVE-2026-50655 HIGH POC
7.8 Jul 14

Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug

CVE-2026-54992 HIGH POC
7.8 Jul 14

Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component

CVE-2026-50489 HIGH POC
7.8 Jul 14

Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem

CVE-2026-50667 HIGH POC
7.0 Jul 14

Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c

CVE-2026-57092 CRITICAL
9.9 Jul 14

Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating

CVE-2026-56190 CRITICAL
9.8 Jul 14

Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary

Share

CVE-2026-58540 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy