What is the CVSS score of EUVD-2026-35742?

EUVD-2026-35742 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Microsoft Winlogon are affected by EUVD-2026-35742?

Microsoft Winlogon vulnerability (CVE-2026-42989) enables authenticated users with local system access to gain administrator-level privileges.. A patch is available.

How to fix or mitigate EUVD-2026-35742?

Within 24 hours: Inventory all Windows systems and document current Winlogon patch status. Within 7 days: Deploy Microsoft's released security patch to all Windows systems, prioritizing servers and high-value workstations. Within 30 days: Confirm 100% patch deployment completion and validate remediation through automated scanning.

Microsoft Winlogon EUVD-2026-35742

| CVE-2026-42989 HIGH

Improper Link Resolution Before File Access (CWE-59)

2026-06-09 secure@microsoft.com

GHSA-2m3h-x8jm-fmwh

Information Disclosure

7.8

CVSS 3.1 · NVD

Temporal: 6.8

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CIRCL (temporal)

6.8 MEDIUM

cvss

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 18:45 vuln.today

DescriptionNVD

Improper link resolution before file access ('link following') in Winlogon allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in Microsoft Winlogon allows authenticated low-privileged users to gain elevated (SYSTEM-level) privileges by abusing improper link resolution before file access. The flaw is rooted in CWE-59 (link following) within the Windows logon component, and while no public exploit has been identified at time of analysis, the CVSS 7.8 rating reflects the high impact to confidentiality, integrity, and availability once a local attacker has a foothold. Microsoft has released a patch via the MSRC advisory.

Technical ContextAI

Winlogon (winlogon.exe) is the Windows component responsible for handling user logons, logoffs, secure attention sequence (Ctrl+Alt+Del), and loading the user profile and shell. It runs as a privileged SYSTEM process and interacts with the local filesystem during session setup. The underlying weakness is CWE-59 (Improper Link Resolution Before File Access, aka 'link following'): Winlogon performs a file operation on a path that an attacker can influence via a symbolic link, junction, or hard link, causing the privileged process to read, write, or modify a file the unprivileged attacker could not normally access. This class of bug is a well-known Windows EoP primitive frequently abused via NTFS junctions and object-manager symlinks.

RemediationAI

Apply the Microsoft-released security update referenced in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42989 through Windows Update, WSUS, or your standard patch-management pipeline; the input confirms a vendor patch is available but does not enumerate a specific KB or build number, so consult the MSRC update guide for the exact package for each Windows SKU in your fleet. Until patches are deployed, reduce local-attack exposure by tightening who can obtain interactive or RDP sessions on sensitive hosts (domain controllers, jump boxes, developer workstations) and by enabling and monitoring Sysmon/EDR detections for symbolic-link and junction creation in user-writable directories that are later accessed by SYSTEM processes - note that broadly blocking symlink creation can break legitimate developer tooling and container workloads, so apply such controls selectively. Disabling Winlogon is not a viable workaround as it is required for interactive logon.