EUVD-2026-43777
GHSA-cwx9-j747-4x45
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local link-following EoP needs an existing low-privileged account (AV:L, PR:L) and no interaction (UI:N); successful abuse yields SYSTEM, giving full C/I/A impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Improper link resolution before file access ('link following') in Window PC Manager allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in Microsoft PC Manager allows an authenticated low-privileged user to gain elevated (typically SYSTEM/administrator) privileges by abusing improper link resolution before file access (CWE-59). Reported by Microsoft with a patch available via MSRC; no public exploit identified at time of analysis and not listed in CISA KEV. The CVSS 7.8 score reflects high confidentiality, integrity, and availability impact once the local, low-privilege prerequisites are met.
Technical ContextAI
Microsoft PC Manager is a Windows optimization and cleanup utility (CPE cpe:2.3:a:microsoft:microsoft_pc_manager) that runs privileged background components to perform system maintenance tasks (disk cleanup, temp file deletion, health scans). The root cause is CWE-59, 'Improper Link Resolution Before File Access (link following)': a privileged process operates on a file or directory path without safely resolving symbolic links, junctions, or hard links first. On Windows this class is commonly exploited via NTFS junctions or object-manager symlinks, allowing a low-privileged user to redirect a privileged file operation (create, write, or delete) to a target the attacker could not otherwise access, resulting in privilege escalation.
RemediationAI
Patch available per vendor advisory: apply the Microsoft-provided update for PC Manager referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58636, and confirm the fixed build against the MSRC guide since an exact fixed version is not enumerated in the available data. Because PC Manager auto-updates, ensure the application is allowed to update and verify the installed version afterward. As a compensating control on sensitive or multi-user hosts, uninstall Microsoft PC Manager if it is non-essential (trade-off: loss of its maintenance features), or restrict interactive/local login on the host to trusted administrators to remove the low-privileged foothold this local EoP requires (trade-off: reduced shared-host usability). Monitor for suspicious junction/symlink creation in directories touched by the PC Manager service as a detection measure.
More in Microsoft Pc Manager
View allLocal privilege escalation in Microsoft PC Manager lets an already-authenticated low-privileged user abuse improper symb
Local privilege escalation in Microsoft PC Manager allows an authenticated low-privileged user on Windows to gain higher
Local privilege escalation in Microsoft PC Manager allows an authenticated low-privileged attacker to gain elevated righ
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today