EUVD-2026-56340
GHSA-m4w5-xvq5-9w6f
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Local low-privilege session required to invoke unguarded firewall service; high integrity impact reflects full firewall rule manipulation; no confidentiality or availability consequence.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Missing authorization in Windows Defender Firewall Service allows an authorized attacker to bypass a security feature locally.
AnalysisAI
Windows Defender Firewall Service across Windows 10, Windows 11, and Windows Server 2019 through 2025 contains a missing authorization flaw (CWE-862) that enables a locally authenticated low-privileged attacker to bypass firewall security controls and manipulate firewall rules without the required authorization. The vulnerability carries a CVSS score of 5.5 with High integrity impact, reflecting the attacker's ability to fully undermine the local firewall enforcement boundary from a standard user session. No public exploit code or CISA KEV listing has been identified at time of analysis, though the post-exploitation value as a lateral movement enabler is notable given the breadth of affected Windows versions.
Technical ContextAI
The vulnerable component is the Windows Defender Firewall Service, a core Windows OS service responsible for enforcing inbound and outbound network traffic filtering rules and security policies at the host level. CWE-862 (Missing Authorization) identifies the root cause: the service exposes one or more API or service interfaces that perform security-sensitive operations - such as modifying firewall rule sets - without verifying that the calling principal holds the required authorization level. This is distinct from an authentication bypass; the attacker already has a valid authenticated local session (PR:L), but the service fails to enforce the privilege boundary between a standard user context and the elevated rights required to alter firewall state. Affected builds span Windows 10 Version 1809 through Windows 11 Version 26H1 and Windows Server 2019 through 2025, as confirmed by ENISA EUVD-2026-56340 and the Microsoft MSRC advisory.
RemediationAI
Apply Microsoft's vendor-released security updates immediately via Windows Update, WSUS, or Microsoft Update Catalog. The minimum patched builds per EUVD data are: Windows 10 Version 1809 and Windows Server 2019 at 10.0.17763.9115, Windows 10 Version 21H2 at 10.0.19044.7663, Windows 10 Version 22H2 at 10.0.19045.7663, Windows 11 Version 23H2 at 10.0.22631.7517, Windows 11 Version 24H2 at 10.0.26100.9168, Windows 11 Version 25H2 at 10.0.26200.9168, Windows 11 Version 26H1 at 10.0.28000.2704, Windows Server 2022 at 10.0.20348.5499, and Windows Server 2025 (including Server Core) at 10.0.26100.33296. For environments where immediate patching is operationally constrained, reduce exposure by restricting interactive local logon rights for non-administrative accounts via Group Policy, enforcing Credential Guard and application control policies (AppLocker or Windows Defender Application Control) to limit which processes can interact with Firewall Service APIs, and auditing local user accounts for unnecessary privilege elevation. Note that these compensating controls reduce the attack surface but do not eliminate the authorization flaw - patching remains the only definitive fix. Full advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-61936.
More in Windows 10 1809
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
Windows Win32k contains an out-of-bounds write vulnerability enabling local privilege escalation to SYSTEM, exploited by
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
Windows contains an elevation of privilege vulnerability known as 'HiveNightmare' or 'SeriousSAM' where overly permissiv
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Internet Shortcut Files Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is rem
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today