Privilege Escalation
Monthly
Heap-based buffer overflow in the Windows Biometric Service (WBS) enables network-reachable privilege escalation to full system control on a broad range of Windows client and server releases. An authorized, low-privileged attacker who can induce user interaction can corrupt heap memory in the biometric service process and achieve arbitrary code execution at elevated privilege. Microsoft has released patches addressing all listed affected versions via the MSRC update guide.
Privilege escalation via use-after-free in Windows Credential Providers allows a local, low-privileged authenticated attacker to gain full system control on Windows 11 and Windows Server 2025. The CWE-416 flaw exists in the credential provider subsystem, which handles authentication UI interactions; triggering the UAF condition (AC:H) under the right timing yields C:H/I:H/A:H impact. No public exploit or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches across all affected Windows 11 and Server 2025 builds.
Local privilege escalation in the Windows Device Association Service enables an authenticated low-privileged attacker to gain full SYSTEM-level control via a use-after-free memory corruption flaw. The vulnerability spans Windows 10, Windows 11, and Windows Server 2019 through 2025, representing an extraordinarily broad attack surface across enterprise and consumer environments. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, though the CVSS 7.0 rating reflects realistic difficulty from high attack complexity (AC:H).
Use-after-free in the Windows Hello authentication subsystem on Windows 10 and 11 allows a locally authenticated, low-privileged user to escalate privileges beyond their security boundary. The CVSS scope-change indicator (S:C) confirms that successful exploitation crosses into a more privileged security context - likely SYSTEM or kernel-level - with full confidentiality, integrity, and availability impact. Vendor patch is available via Microsoft's update guide; no public exploit code has been identified at time of analysis.
Stack-based buffer overflow in the Windows Win32K kernel-mode driver enables a low-privileged authenticated attacker to escalate privileges to SYSTEM level via a network-accessible exploit path, affecting 12 distinct Windows releases spanning Windows 10 1809 through Windows Server 2025 and Windows 11 26H1. The CWE-121 flaw resides in the kernel subsystem handling GDI rendering and windowing, making successful exploitation equivalent to full operating system compromise. Microsoft has released patches addressing all affected build ranges; no public exploit code or CISA KEV listing has been identified at time of analysis.
Use-after-free (CWE-416) in the Windows TCP/IP networking stack enables an authenticated, low-privileged attacker to escalate privileges to a higher trust level via a network-based attack path. The vulnerability affects a broad surface - Windows 10 through Windows 11 and Windows Server 2012 through 2025 - making the potential impact wide despite the elevated attack complexity (AC:H) and required user interaction (UI:R) constraints in the CVSS vector. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Use-after-free in the Windows TCP/IP driver allows a network-adjacent low-privileged authenticated attacker to escalate privileges to SYSTEM on affected Windows 10, Windows 11, and Windows Server 2019-2025 installations. The CVSS:3.1 vector (AV:N/AC:H/PR:L/UI:R) indicates exploitation requires high attack complexity and user interaction, consistent with a race-condition-triggered UAF in the kernel networking stack. No public exploit code or CISA KEV entry has been identified at time of analysis, but the broad affected product surface and the Microsoft-origin report make this a priority for enterprise patch cycles.
Privilege escalation in Windows Hello on Windows 11 allows a low-privileged local attacker to gain SYSTEM-level or kernel-level access via a use-after-free memory corruption flaw (CWE-416). Affected builds span all currently supported Windows 11 feature releases (23H2, 24H2, 25H2, and 26H1) prior to Microsoft's July 2026 security update. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the low complexity and absence of required user interaction make this a high-value second-stage escalation primitive.
Use-after-free (UAF) in the Windows Device Association Broker service enables a local, low-privileged authenticated attacker to escalate privileges to SYSTEM or higher on a broad range of Windows 10, Windows 11, and Windows Server releases. The vulnerability (CWE-416) is consistent with a race condition in the Broker's memory management, as reflected by the AC:H metric, and exploitation yields full confidentiality, integrity, and availability impact on the local system. No public exploit code has been identified at time of analysis, but Microsoft has released patches across all affected build streams.
Use-after-free memory corruption in Windows Audio Service enables local privilege escalation across the full Windows ecosystem, from Windows 10 1607 through Windows 11 26H1 and all supported Windows Server releases from 2012 through 2025. The CVSS vector (AV:L/AC:H/PR:L) confirms a locally authenticated attacker must navigate high-complexity exploit conditions - likely a race or timing attack on the audio service's memory lifecycle - before achieving full C:H/I:H/A:H impact, including arbitrary code execution at elevated privilege. No public exploit code has been identified at time of analysis, but Microsoft has released patches for all listed affected builds.
Privilege escalation in Windows Host Guardian Service (HGS) allows a low-privileged local attacker to gain SYSTEM-level access through a use-after-free memory corruption triggered by a race condition. Affected products span Windows 10 and 11 client editions alongside Windows Server 2019, 2022, and 2025, covering a broad enterprise and consumer Windows footprint across multiple build lines. Microsoft has released patches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Windows Accounts Control allows an authorized local attacker to gain elevated system access by exploiting a use-after-free memory corruption flaw (CWE-416). The vulnerability spans a broad range of Windows 10, 11, and Windows Server editions from build 14393 through build 28000, making the exposure surface wide across enterprise and consumer deployments. Microsoft has released patches; no public exploit code or CISA KEV listing exists at time of analysis, though the AC:H vector indicates a race-condition-dependent trigger consistent with timing-sensitive UAF exploitation.
Privilege escalation through a use-after-free condition in the Windows Win32K kernel subsystem allows a low-privileged local attacker to achieve SYSTEM-level access across a wide range of Windows client and server releases, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. The flaw resides in win32k.sys, the kernel-mode driver implementing the Windows graphical subsystem (GDI/USER32), and requires high attack complexity to trigger reliably - consistent with race-condition or heap-grooming exploitation techniques. No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available from Microsoft MSRC.
Privilege escalation in the Windows exFAT File System driver (CWE-125, out-of-bounds read) allows an authenticated low-privilege attacker to gain elevated rights over a network connection. All major Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025 are confirmed affected per EUVD version data. No public exploit or CISA KEV listing was identified at time of analysis, though the broad affected scope across the entire current Windows ecosystem and the high CVSS score of 8.0 make patching urgent.
Privilege escalation in Windows Shell on Windows 11 (versions 23H2 through 26H1) and Windows Server 2025 stems from a use-after-free memory corruption flaw (CWE-416). An authenticated local attacker who triggers the race-condition-sensitive bug can achieve full system compromise with C:H/I:H/A:H impact, yielding effective SYSTEM-level control. No public exploit or CISA KEV listing has been identified at time of analysis; Microsoft has confirmed and patched the issue across all affected builds as documented in EUVD-2026-73549.
Local privilege escalation in Windows Device Association Service exposes all supported Windows client and server editions to full system compromise by a low-privileged local attacker. The root cause is a use-after-free triggered through a race condition (CWE-362): concurrent access to a shared resource in the Device Association Service allows a freed memory object to be reused, enabling controlled code execution in a higher-privilege context. No public exploit or CISA KEV listing is present at time of analysis, but the breadth of affected versions - spanning Windows 10 through Windows 11 26H1 and Windows Server 2012 R2 through 2025 - makes this a high-priority patch for any environment with untrusted local users.
Local privilege escalation in Windows Storage Spaces Controller via a use-after-free memory corruption flaw enables an authenticated low-privilege attacker to gain SYSTEM-level access on affected Windows 10, Windows 11, and Windows Server 2016 through 2025 installations. The vulnerability (CWE-416) exists in the Storage Spaces Controller kernel driver; exploiting it yields full confidentiality, integrity, and availability impact on the local system. No public exploit code or active exploitation confirmed at time of analysis, but the breadth of affected Windows versions makes this a broad-footprint local privilege escalation risk.
Local privilege escalation in the Windows Universal Disk Format File System Driver (UDFS) allows a low-privileged authenticated attacker to gain full control of an affected system through a use-after-free memory corruption condition. The vulnerability spans virtually the entire supported Windows ecosystem, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit identified at time of analysis, and Microsoft has released patches addressing the flaw across all affected builds.
Local privilege escalation in Windows NTFS exposes a use-after-free condition in the kernel-mode filesystem driver, allowing an authenticated local attacker with low privileges to achieve full SYSTEM-level control. The vulnerability spans virtually the entire supported Windows ecosystem - from Server 2012 through Windows 11 26H1 and Windows Server 2025 - making it broadly applicable in enterprise environments. No public exploit or CISA KEV listing has been identified at time of analysis, though the AC:H rating suggests exploitation requires a specific timing or memory-layout condition such as a race condition, limiting opportunistic mass exploitation.
Local privilege escalation in Windows Spaceport.sys, the kernel-mode Storage Spaces driver, allows an authenticated low-privileged local attacker to execute arbitrary code in kernel context, achieving full SYSTEM-level control with no user interaction. The flaw is an out-of-bounds read (CWE-125) in the kernel driver, exploitable across virtually every supported and extended-support Windows release from Server 2012 through Windows 11 26H1 and Server 2025. Microsoft has released patched builds for all affected versions; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Privilege escalation via out-of-bounds read in Windows NTFS affects a broad range of Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. An authorized (low-privilege) network attacker who can trigger specific NTFS parsing behavior - requiring user interaction - can achieve full compromise of confidentiality, integrity, and availability, effectively gaining system-level access. No public exploit has been identified at the time of analysis, but a vendor-released patch is available and should be prioritized given the breadth of affected OS versions.
Privilege escalation in the Windows Win32K kernel-mode GUI subsystem allows a low-privileged local user to gain SYSTEM-level access via a use-after-free memory corruption condition. The vulnerability affects a broad span of Windows 10, Windows 11, and Windows Server 2019/2022/2025 releases, making it highly relevant to enterprise endpoint and server environments. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches across all affected version branches.
Use-after-free in the Windows Human Interface Devices kernel subsystem allows a local, low-privileged user to escalate to SYSTEM-level control. Affecting virtually all current Windows desktop and server releases - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), Windows Server 2016 through 2025 - successful exploitation requires local session access and precise timing but yields full C:H/I:H/A:H kernel impact. No active exploitation has been confirmed (no CISA KEV listing) and no public proof-of-concept is known; Microsoft has released patches for all affected build branches.
Privilege escalation in Microsoft SharePoint Server Subscription Edition enables any authenticated network user to gain elevated privileges with full confidentiality, integrity, and availability impact. The root cause is CWE-250 (Execution with Unnecessary Privileges), where a SharePoint service or component operates with more privilege than its function requires, allowing a low-privileged account to cross privilege boundaries. No active exploitation has been confirmed and no public exploit code has been identified; a vendor patch is available targeting build 16.0.20326.20090.
Use-after-free in Windows Modern Device Management (MDM) enables a low-privileged authenticated attacker to escalate to SYSTEM-level privileges across a broad swath of Windows 10, Windows 11, and Windows Server releases. The CVSS vector (AV:N/AC:H/PR:L/UI:R) indicates the attack is network-reachable but constrained by high exploitation complexity and required user interaction, limiting opportunistic mass exploitation. Microsoft has released patched builds; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation via out-of-bounds read in Windows BitLocker affects a broad swath of Microsoft operating systems from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across multiple feature updates. A low-privileged network-authenticated attacker who can induce user interaction can trigger CWE-125 memory reads beyond buffer boundaries in the BitLocker component, ultimately achieving elevation of privileges with full confidentiality, integrity, and availability impact (CVSS 8.0). No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches addressing all confirmed affected versions.
Local privilege escalation in Windows Error Reporting (WER) across virtually all supported Windows releases exploits an out-of-bounds read (CWE-125) to allow a low-privileged authenticated local user to gain SYSTEM-level access with full confidentiality, integrity, and availability impact. The breadth of affected platforms is significant, spanning Windows 10 versions 1607 through 22H2, Windows 11 versions 23H2 through 26H1, and Windows Server 2012 through Server 2025 including Server Core installations. No public exploit code has been identified at time of analysis, and Microsoft has released patches through the standard Windows Update channel.
Privilege escalation in Windows USB Audio Class driver (usbaudio.sys) allows a local authenticated user to gain SYSTEM-level access via a use-after-free memory corruption condition. Affected versions span the entire supported Windows ecosystem from Server 2012 through Windows 11 26H1 and Windows Server 2025, making patch deployment at scale a significant operational task. No public exploit or CISA KEV listing is confirmed at time of analysis, but the AC:H rating reflects a race-condition exploitation window rather than a trivial trigger, distinguishing this from mass-exploitable LPE bugs.
Local privilege escalation in the Windows TCP/IP stack exploits a race condition (CWE-362) to allow a low-privileged local user to gain full system-level control across virtually every supported Windows release. The vulnerability spans Windows 10 through Windows 11 25H2 and Windows Server 2012 through Server 2025, making the breadth of exposure exceptionally wide. Microsoft has released patches; no public exploit or CISA KEV listing was identified at time of analysis, but the scope of affected systems elevates organizational urgency.
Privilege escalation in Windows Bluetooth Service via a use-after-free (CWE-416) allows a low-privileged local user to achieve full system compromise across a broad range of Windows 10, Windows 11, and Windows Server releases. The CVSS vector (AV:L/AC:H/PR:L) indicates the flaw requires local access and elevated attack complexity - consistent with a race condition in Bluetooth service memory management - but yields full confidentiality, integrity, and availability impact upon successful exploitation. No public exploit code has been identified at time of analysis, and Microsoft has released patches via its regular update channel.
Privilege escalation via use-after-free (CWE-416) in the Windows Kernel enables a network-accessible, low-privileged authenticated user to elevate to SYSTEM privileges across a broad range of Windows client and server releases spanning Windows 10 through Windows 11 26H1 and Windows Server 2012 through 2025. Microsoft has confirmed and released fixed builds for all affected versions via the MSRC advisory. No public exploit code or CISA KEV listing has been identified at time of analysis; the high attack complexity (AC:H) and mandatory user interaction (UI:R) substantially reduce the near-term risk of automated mass exploitation despite the full C:H/I:H/A:H impact triad.
Local privilege escalation in Windows Error Reporting (WER) exploits a use-after-free condition (CWE-416), enabling an authenticated low-privileged attacker to gain SYSTEM-level access on affected Windows systems. The flaw spans a wide range of platforms from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. Microsoft has released patches; no public exploit or CISA KEV listing is present at time of analysis, though the high attack complexity (AC:H) suggests a race condition or timing-dependent exploitation path.
Heap-based buffer overflow in the Win32K kernel subsystem (CWE-122) on Windows 11 and Windows Server 2025 enables a low-privileged local attacker to escalate to SYSTEM-level privileges. Affected builds span Windows 11 24H2, 25H2, and 26H1 as well as Windows Server 2025 and its Server Core variant, per EUVD-2026-73467. Microsoft has released patches addressing all affected versions; no public exploit or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Image Acquisition (WIA) allows an attacker with a low-privilege local account to gain SYSTEM-level access via a use-after-free memory corruption bug. The vulnerability spans nearly every supported Windows release from Server 2012 through Windows 11 26H2, making it a broadly applicable LPE primitive for post-exploitation chains. No public exploit or active exploitation has been identified at time of analysis; Microsoft has released patches through standard monthly update guidance.
Local privilege escalation in Windows Win32K (the kernel-mode graphics subsystem) allows a low-privileged authenticated user to gain SYSTEM-level access by triggering a use-after-free condition. Affected across a wide span of Windows desktop and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. No public exploit code has been identified at time of analysis, and the high attack complexity rating (AC:H) in the CVSS vector suggests reliable exploitation requires precise memory timing or race-condition manipulation.
Privilege escalation in the Windows USB Video Driver allows a locally authenticated attacker to gain SYSTEM-level access by exploiting a race condition in the driver's concurrent execution path. Affecting Windows releases from Server 2012 through Windows 11 26H1 and Windows Server 2025, the flaw (CWE-362) requires low-privilege code execution and tolerates no user interaction, but the high attack complexity reflects the timing window inherent to exploiting a race. No public exploit code or CISA KEV listing has been identified at time of analysis, though Microsoft has released patches across all affected branches.
Privilege escalation to SYSTEM via use-after-free in the Windows Audio Service affects a broad range of Windows 10, 11, and Windows Server versions from 2012 R2 through 2025. An authenticated local attacker can exploit a memory management flaw in the Audio Service to free an object while a reference to it remains live, then redirect execution to gain full C:H/I:H/A:H impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the wide product footprint and low privilege requirement make this a meaningful patching priority.
Privilege escalation via use-after-free in the Windows DNS service affects Windows 10, Windows 11, and Windows Server versions from 2012 R2 through 2025, allowing a locally authenticated low-privileged user to gain SYSTEM-level access. The CWE-416 flaw involves improper memory management in DNS handling routines where freed memory can be accessed and manipulated by an attacker with high-complexity exploitation - consistent with heap-grooming or race-condition prerequisites. Microsoft has released patches across all affected version lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Use-after-free in the Windows Search Component enables an authenticated low-privileged network attacker to elevate privileges, potentially achieving full system compromise (C:H/I:H/A:H). The vulnerability spans virtually the entire modern Windows ecosystem - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making the unpatched population extremely large. Microsoft has released specific patch builds for each affected platform; no public exploit code or CISA KEV listing has been identified at time of analysis, but AC:H and UI:R constrain opportunistic mass exploitation.
Local privilege escalation in Microsoft COM for Windows allows a low-privileged authenticated attacker to gain full SYSTEM-level control via a use-after-free memory corruption flaw. The vulnerability affects a broad range of current Windows client and server releases, from Windows 10 21H2 through Windows 11 25H2 and Windows Server 2022/2025. Microsoft has released patches via the standard update guide; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation via an out-of-bounds read in the Windows USB Driver affects a broad range of Windows client and server editions, enabling a locally authenticated low-privilege attacker to gain full SYSTEM-level control without user interaction. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects low attack complexity with no special setup required beyond a valid local session. No public exploit code or CISA KEV listing has been identified at time of analysis, though the ubiquitous Windows footprint and accessibility of the USB driver to standard user accounts make this a credible post-compromise privilege escalation primitive.
Use-after-free in Windows Remote Desktop Services enables a low-privileged local attacker to escalate privileges to SYSTEM on affected Windows hosts. The vulnerability spans Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, making the attack surface extremely broad across enterprise fleets. No public exploit code or CISA KEV active-exploitation entry has been identified at time of analysis; a vendor-released patch is available.
Local privilege escalation in Windows License Manager exposes authenticated local users to full system compromise via a use-after-free condition (CWE-416). An attacker with a low-privileged local session who can win a memory-management race condition can corrupt heap state and redirect execution to gain SYSTEM-level privileges across a wide range of Windows 10, 11, and Server editions. No active exploitation is confirmed (absent from CISA KEV) and no public exploit code has been identified, but the breadth of affected Windows versions - from Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025 - makes this a meaningful patch priority for multi-user and enterprise Windows environments.
Heap-based buffer overflow in Microsoft Standard XPS (XML Paper Specification), the Windows-integrated document format and print subsystem, enables a low-privileged local user to escalate to SYSTEM or administrator-level privileges across a broad range of Windows desktop and server releases. The flaw falls under CWE-122 and, given AC:L/PR:L/UI:N, requires only an existing standard user session and the ability to trigger XPS processing - no race condition or second-user interaction is needed. Microsoft has released patches for all affected builds; no public exploit code has been identified at time of analysis.
Use-after-free in the Windows Connected User Experiences and Telemetry service (DiagTrack) enables a locally-authenticated low-privileged attacker to escalate privileges to SYSTEM-level access. The vulnerability affects a broad range of current Windows releases - Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2/26H1, Windows Server 2022, and Windows Server 2025 - all receiving patched builds via Microsoft's update cycle. No public exploit code or CISA KEV listing has been identified at time of analysis, but the local privilege-escalation class and high C/I/A impact make this a credible post-compromise escalation path.
Privilege escalation via use-after-free in the Windows File History Service allows a local authenticated attacker to gain full system-level access. The vulnerability affects a wide range of Windows 10, Windows 11, and Windows Server 2016/2019 builds, patched by Microsoft in the corresponding Patch Tuesday update cycle. No public exploit or CISA KEV listing is present at time of analysis, but the High CVSS score (7.0) and C:H/I:H/A:H impact metrics reflect the severity of successful exploitation.
Local privilege escalation in Windows Connected User Experiences and Telemetry (DiagTrack) allows an authenticated local user to elevate to SYSTEM-level privileges by winning a race condition against the SYSTEM-privileged service. The flaw spans Windows 10 21H2/22H2, Windows 11 23H2 through 26H1, Windows Server 2022, and Windows Server 2025, all remediated in the associated Patch Tuesday release. No public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Microsoft SQL Server (versions 2017, 2019, 2022, and 2025) allows a low-privileged authenticated user to elevate their database permissions to a higher role over the network via CWE-269 improper privilege management. With a CVSS 8.8 score and vector AV:N/AC:L/PR:L, the flaw requires only a valid SQL Server login - no attack complexity, no user interaction - and yields full confidentiality, integrity, and availability impact on the database instance. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the near-zero exploitation prerequisites within a widely deployed enterprise platform make urgent patching essential.
Privilege escalation in Microsoft SQL Server allows an authenticated low-privileged network attacker to gain complete control over affected database instances across SQL Server 2017, 2019, 2022, and 2025. The flaw stems from CWE-1220 (Insufficient Granularity of Access Control), where the access control model fails to enforce fine-grained permission boundaries, permitting a standard database login to exceed its intended privilege scope. No active exploitation has been confirmed by CISA KEV and no public proof-of-concept has been identified, but the broad version coverage and full C:H/I:H/A:H CVSS impact make patching urgent. Vendor-released patches are available across all affected release tracks.
Local privilege escalation in Windows Push Notifications affects Windows 10, Windows 11, and Windows Server 2022/2025 via a use-after-free (CWE-416) memory corruption flaw, allowing a low-privileged authenticated local user to obtain SYSTEM-level execution. The vulnerability spans nine distinct Windows release branches - including server editions - broadening the enterprise attack surface. No public exploit code or CISA KEV listing has been identified at time of analysis; however, LPE primitives of this class are routinely integrated into post-initial-access attack chains.
Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows an authenticated local attacker with low privileges to gain SYSTEM-level access via a race condition in kernel-level socket processing. The CVSS vector (AV:L/AC:H/PR:L/UI:N) reflects that exploitation requires an existing low-privilege foothold, precise timing to win the race window, but no user interaction. Microsoft has released patches across a wide range of supported Windows versions. No public exploit or CISA KEV listing has been identified at time of analysis, though race-condition LPE bugs in Windows kernel drivers are a favored post-exploitation technique.
Overly permissive ClusterRole in hawtio-operator amplifies the blast radius of any operator-pod compromise to cluster-wide Secret exposure. The operator's ServiceAccount is granted secrets: [create, get, list, update, watch] across all Kubernetes namespaces with no scope restriction, meaning an attacker who gains code execution in the operator pod can immediately read every Secret in the cluster - bootstrap tokens, cloud provider credentials, and secrets belonging to other operators. No public exploit code has been identified at time of analysis, but the vulnerability is a structural privilege misconfiguration that persists for the lifetime of any deployment running the default ClusterRole.
Privilege escalation in TYPO3 CMS 14.2.0-14.3.6 allows backend administrators without system-maintainer privileges to schedule configuration commands (configuration:set, configuration:show, configuration:read) through the TYPO3 scheduler module, bypassing the role-based authorization that normally restricts these operations to the highest privilege tier. An attacker holding a backend administrator account can leverage this to silently elevate themselves to system-maintainer status or corrupt system configuration to trigger a denial of service. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Privilege escalation in Dell Secure Connect Gateway (SCG) 5.0 allows a local attacker with basic system access to gain full administrative control of the affected host. The root cause is improper privilege management (CWE-269) in both the SCG 5.0 Application (prior to 5.36.00.00) and SCG 5.0 Appliance (prior to 5.36.00.16), as confirmed by Dell advisory DSA-2026-382. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.
Privilege escalation in JetBrains YouTrack before version 2026.2.18634 enables authenticated low-privileged users to alter group memberships without proper server-side authorization validation, effectively granting themselves elevated rights. The flaw (CWE-266, Incorrect Privilege Assignment) means the application trusts client-supplied group membership parameters without enforcing that the requesting user has the authority to make such changes. With a CVSS base score of 8.8 and full C:H/I:H/A:H impact, successful exploitation yields the equivalent of full administrative control over the YouTrack instance.
Privilege escalation in WP Fusion (Pro) for WordPress allows authenticated attackers with Subscriber-level access to create new administrator accounts and achieve full site compromise. The vulnerability resides in the ThriveCart Auto Login handler's `thrivecart()` function, which fails to enforce authorization on the `role` parameter during user account creation, enabling callers to self-assign the `administrator` role. The required access_key is distributed openly to all ThriveCart customers as part of the plugin's documented setup, substantially lowering the practical barrier for anyone who has transacted with the target site's ThriveCart storefront; no public exploit or CISA KEV listing has been identified at time of analysis.
Local privilege escalation to root in Dell Secure Connect Gateway (SCG) 5.0 lets a low-privileged operator with SSH access to the appliance host obtain full root control without a password by abusing the exposed Docker socket (CWE-250, Execution with Unnecessary Privileges). Affected builds are the SCG Appliance prior to 5.36.00.16 and the SCG Application prior to 5.36.00.00. The same socket exposure also enables container escape: an attacker who compromises any service inside the orchestrator container can break out to host-level control. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the technique (writable/accessible Docker socket) is a well-known and reliable escalation path.
Local privilege escalation in Dell Secure Connect Gateway 5.0 enables a low-privileged authenticated user with local shell access to gain elevated - likely root or administrator-level - control of the affected host. Both the virtual appliance (prior to 5.36.00.16) and standalone application (prior to 5.36.00.00) deployments are affected, as confirmed by Dell advisory DSA-2026-382. No public exploit code or active exploitation has been identified, and vendor-released patches are available for both product variants.
Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset variants via a heap-based out-of-bounds write stemming from a missing bounds check (CWE-122). An unprivileged local process on any affected device can trigger the flaw to achieve full kernel-level read, write, and execute access without requiring any user interaction. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the sheer breadth of affected chipsets across MediaTek's mid-range and budget device portfolio makes systematic patch deployment a significant supply-chain challenge.
Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged attacker to escalate privileges to kernel level with full system compromise. The CVSS vector (AV:L/AC:L/PR:N/UI:N) reflects that any Android app running on an affected device can trigger this flaw without special permissions or user interaction, consistent with typical Android kernel driver exposure. SSVC rates exploitation as 'none' and the attack as non-automatable, though technical impact is assessed as total; no public exploit or CISA KEV entry exists at time of analysis.
Authorization bypass in MISP's UiBeta theme collection view exposes full event details - including identifiers, info fields, timestamps, creator organization, all event tags, and galaxy clusters - to authenticated users who lack ACL permissions to those events. The UiBeta theme's `view.ctp` template performed an independent secondary database query using only `Event.uuid IN (...)` without invoking `createEventConditions()`, the canonical per-user ACL enforcement method, even though `CollectionsController::view()` correctly filtered events via `Event::fetchSimpleEvents($user, ...)`. The flaw is compounded because `CollectionElementsController::add()` accepts arbitrary UUIDs from collection owners without validating the submitter's authorization against the referenced event, making collection elements an attacker-controlled input to an unfiltered query. No public exploit code has been identified at time of analysis and no CISA KEV listing exists.
Account takeover via insecure direct object reference in the SureCart WordPress plugin (versions 4.0.0 through 4.6.2) allows any subscriber-level authenticated user to seize full control of an administrator account. The plugin's customer update endpoint validates that the requester has permission to update customers, but fails to verify that the target customer record belongs to the requesting user - enabling arbitrary cross-user email modification followed by a password reset. A compounding information disclosure flaw leaks customer identifiers and email addresses to all authenticated users, providing the enumeration primitive needed to complete the takeover chain without any additional knowledge. A publicly available proof-of-concept exploit exists, and vendor patch 4.6.3 is available.
Improper privilege management in the Tenda CP3 IP camera (firmware 27.5.57.101) exposes the CRedirServer::SetRedirectEnable function (Functions/Redirect.cpp) to remote abuse, letting an attacker toggle the device's redirect handling without proper authorization enforcement. The flaw was disclosed by VulDB (vuln #399276) and carries a CVSS 4.0 base score of 9.4, though no public exploit code and no active-exploitation evidence accompany the entry. No public exploit identified at time of analysis, and the single-source, sparse disclosure limits how much of the claimed impact can be independently confirmed.
Privilege escalation in MikroTik RouterOS lets a remote, unauthenticated attacker abuse the SSH login helper to rewrite the trusted RouterOS policy mask by supplying a username that begins with a prohibited character. Because the flaw is reached before authentication completes, an attacker who can open an SSH session to an affected device can escalate to full administrative privileges. Publicly available exploit code exists, and CERT-PL (the reporter) has published a companion advisory describing these RouterOS issues as actively exploited, though the CVE is not confirmed on CISA KEV in the provided data.
Privilege escalation in grav-plugin-api before 1.0.20 allows a low-privileged API manager to self-create a super-admin account by exploiting a logic gap in the InvitationsController's stripSuperFlags() method, which strips nested super flags but ignores dot-keyed equivalents such as 'api.super'. The attacker crafts an invitation payload containing the dot-keyed flag, which persists through sanitization into the new account, then self-accepts the invitation via the public acceptance endpoint - no real invitee participation required - and immediately receives a valid JWT granting full Grav site control. No public exploit or CISA KEV listing is present at time of analysis, but the attack is fully self-contained and conceptually trivial for any account already holding api.users.write permissions.
Privilege escalation in the Abandoned Cart Pro for WooCommerce WordPress plugin (all versions through 10.7.1) allows authenticated subscribers to gain full WordPress administrative access by hijacking the plugin's SMTP email routing. Missing capability checks and nonce verification on at least four AJAX endpoints - including wcap_save_connector_settings - permit any subscriber-level user to silently redirect outbound SMTP traffic through an attacker-controlled mail server. Once SMTP is redirected, the attacker intercepts auto-login recovery links sent to administrators and authenticates as admin without any further credentials. No public exploit has been identified at time of analysis, but the attack exploits a default-enabled feature, significantly lowering the bar for abuse on any standard installation.
Site takeover in the SEO Flow by LupsOnline WordPress plugin (versions 3.0.0 through before 3.0.3) stems from improper validation of the credential supplied with the plugin's API requests, allowing unauthenticated attackers to be served in the security context of the administrator who configured the plugin. Because the flaw grants effective administrator-level access, an attacker can fully compromise the affected WordPress site. Publicly available exploit code exists (published by WPScan), though EPSS remains low at 0.15% (4th percentile), and there is no public exploit identified as active in the wild.
Privilege escalation in Inductive Automation Ignition 8.1.53 and earlier allows any authenticated user who can execute gateway scripts to create SCADA/HMI projects without restriction, because the Gateway 'Create Project Role(s)' setting shipped with a blank default - effectively disabling the access control gate entirely. In industrial control system (ICS) environments, unauthorized project creation is operationally significant: projects define the logic, tags, and screens that interact with physical process equipment. Ignition 8.1.54 closes the gap by restricting project creation to Designer sessions, removing reliance on the misconfigured role setting. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Privilege escalation in PassMark's shared DirectIo64.sys kernel driver, bundled with PerformanceTest (before 11.1 build 1012), BurnInTest (before 11.1 build 1000), and OSForensics (before 11.1 build 1016), allows any low-privileged local user to gain complete hardware-level control over the host. The driver exposes IOCTLs without validating the target device, register offset, or value, enabling arbitrary PCI configuration space reads and writes. An attacker can leverage this to enable Bus Master DMA on any PCI device, remap Base Address Registers to attacker-controlled physical memory addresses, or halt storage controller I/O - all without kernel exploits. A public proof-of-concept is available; no active exploitation (CISA KEV) confirmed at time of analysis.
Local privilege escalation in Acunetix 25.11.251107123 for Windows enables low-privileged local users to execute arbitrary code as SYSTEM by exploiting CWE-427 (Uncontrolled Search Path Element) in the wvsc.exe Web Vulnerability Scanning Engine. The SYSTEM-level wvsc.exe process searches for OpenSSL-related files at a hardcoded directory path that does not exist by default; an attacker creates the missing directory and plants a malicious file, which the service subsequently loads and executes, yielding full SYSTEM-level control. A public proof-of-concept is available via the Full Disclosure mailing list and corroborated by a VulnCheck advisory, making this trivially reproducible by any local user on affected Windows installations.
Local privilege escalation in JAL Information Technology's Pallet Control suite (including PalletControl and PalletControl Cloud) enables a low-privileged local attacker to execute arbitrary code with SYSTEM-level privileges due to incorrect default installation permissions (CWE-276). All tracked versions across three CPE entries are listed as affected per JPCERT/CC coordination notice JVN#84094853. No public exploit code has been identified at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog.
Unauthenticated account takeover in the ACPT (Premium) WordPress plugin (versions up to and including 2.0.66) lets remote attackers hijack any account, including administrators. The plugin's submit() handler processes anonymous form submissions without verifying that the submitter is authorized to modify the targeted user, then passes an attacker-controlled user ID to wp_update_user(), allowing the attacker to overwrite that user's email address and password. Reported by Wordfence; no public exploit and no CISA KEV listing at time of analysis, but the CVSS 9.8 rating reflects a trivially weaponizable full-compromise path where a vulnerable form is exposed.
Account takeover in slimkit ThinkSNS+ v2.4 allows a remote unauthenticated attacker to hijack arbitrary user accounts by abusing the password-reset flow, where the ResetPasswordController.php component continues to accept verification codes after they should have expired. Because expired codes remain valid (enabling reuse/replay of a code well past its lifetime), an attacker can complete a password reset for a targeted account and gain full control. No public exploit code is confirmed, though a detailed technical writeup exists; EPSS is low (0.21%) and the issue is not on CISA KEV.
Privilege escalation on MBS-Solutions X-Serie Gateway firmware V6_00_05 allows an authenticated low-privileged service user to gain full root access on the device. The firmware grants passwordless sudo execution of /usr/bin/tcpdump as root; by supplying the -z post-rotate flag, the attacker triggers execution of an arbitrary command with root privileges, achieving complete system compromise. A public proof-of-concept is available via the researcher's GitHub repository; no CISA KEV listing has been identified at time of analysis.
Privilege escalation in MBS-solutions X-Serie Gateway firmware V6_00_05 allows a remote attacker to gain elevated privileges by abusing two CGI endpoints, /cgi-bin/wwwugw.cgi and /cgi-bin/ugwdownload.cgi. Per the CVSS vector the attack requires no authentication (PR:N) and yields high confidentiality and integrity impact, effectively granting an attacker administrative control over the gateway's configuration and data. A public write-up and proof-of-concept exist in a GitHub research repository, though there is no evidence of active exploitation.
Privilege escalation in Kibana's Fleet management component allows any user holding Fleet management privileges to mint arbitrarily elevated Elasticsearch cluster credentials - up to full cluster administration - for every Elastic Agent enrolled in a targeted policy. Elasticsearch cluster privilege declarations sourced from integration packages were not validated before being used to generate agent credentials (CWE-863: Incorrect Authorization), enabling an attacker to inject overprivileged credentials across an entire agent fleet. No public exploit has been identified at time of analysis, and CISA KEV status is not confirmed, but the impact is laterally broad: a single privileged user can compromise all agents and the Elasticsearch cluster they authenticate to.
Local privilege escalation in HP Support Assistant (versions prior to 9.53.2.0) allows a low-privileged local user to gain elevated system privileges by exploiting insufficient granularity in access controls (CWE-1220). The vulnerability requires local authenticated access but no user interaction, and the CVSS 4.0 AT:P metric indicates specific attack conditions must be present. No public exploit code or active exploitation has been identified at time of analysis; HP has released a patched version addressing the issue.
Privilege escalation in the Bricksforge WordPress plugin (versions <= 3.1.8.8) lets a low-privileged user elevate their account to higher-privileged roles, per a Patchstack advisory. The flaw (CWE-266, Incorrect Privilege Assignment) carries a CVSS of 9.8 with a network/no-auth vector, though the 'Subscriber Privilege Escalation' label implies a logged-in subscriber account is the realistic starting point. No public exploit code, KEV listing, or EPSS score was provided at time of analysis.
Subscriber-level privilege escalation in WCFM Membership WordPress plugin (versions ≤ 2.11.11) enables any authenticated user holding a basic subscriber account to elevate their role to a higher-privileged level, producing high-integrity impact on the affected WordPress/WooCommerce installation. The flaw falls under CWE-266 (Incorrect Privilege Assignment) and was responsibly disclosed by Patchstack. No public exploit code or active exploitation has been identified at time of analysis, though the low attack complexity and broad attacker pool (any registered subscriber) make this a realistic threat for multivendor marketplace deployments.
Improper authentication in Adobe ColdFusion 2023 and 2025 allows unauthenticated adjacent-network attackers to escalate privileges and gain limited read and write access to affected systems. The vulnerable administrative component is network-restricted by default, which partially contains exposure, but the scope change indicator in the CVSS vector signals that successful exploitation can affect components beyond the directly targeted service. No public exploit code or CISA KEV listing has been identified at time of analysis.
Full account takeover in WWBN AVideo arises because the video_id_hash acts as a non-expiring, non-revocable bearer token that authenticates the holder as the video owner with complete administrator privileges. Any attacker who obtains a valid video_id_hash can replay it indefinitely to gain full admin session access, and the credential keeps working even after the victim rotates their password - eliminating the primary recovery mechanism. Reported by VulnCheck with a fix in the vendor GitHub Security Advisory; no public exploit identified at time of analysis, and no EPSS or KEV data was provided.
Privilege escalation in util-linux through versions 2.41.5 and 2.42.2 allows local low-privilege users to execute privileged post-mount hook operations on pre-existing filesystems by exploiting libmount's failure to validate mount helper exit status before dispatching the MOUNT_POST stage. The root cause - captured by CWE-390 - lies in context_mount.c functions mnt_context_do_mount() and mnt_context_mount(), which gate post-mount hook execution solely on a zero result code without verifying whether the underlying mount helper or kernel syscall actually succeeded. No public exploit code has been identified at time of analysis, but the public GHSA advisory and three upstream patch commits provide sufficient technical detail to support independent exploit development.
Local privilege escalation in Elastic Agent on Windows enables a low-privileged local user to achieve SYSTEM-level code execution by exploiting overly permissive access controls (CWE-732) on resources created during unprivileged-mode installation. The agent service, running as SYSTEM, will execute attacker-controlled binaries placed via the CAPEC-642 binary replacement technique. Vendor-released patches 8.19.21, 9.4.6, and 9.5.2 are available per advisory ESA-2026-150; no public exploit identified at time of analysis.
Privilege escalation in the LiquidThemes Booking Hub WordPress plugin (≤1.3.1) allows authenticated low-privileged users to incorrectly assign themselves or others elevated WordPress roles, up to and including administrator. The flaw stems from CWE-266 (Incorrect Privilege Assignment) - the plugin fails to enforce proper capability checks before processing role or privilege assignment operations. CVSS 8.8 (PR:L) confirms exploitation requires an existing low-privilege account; no public exploit code or CISA KEV listing identified at time of analysis.
Unauthenticated privilege escalation in the WordPress Authorizer plugin (versions 3.15.1 and earlier) lets remote attackers with no credentials elevate themselves to elevated/administrative roles, according to a CVSS 9.8 rating and CWE-266 (incorrect privilege assignment). Authorizer is an authentication/SSO plugin, so a flaw in its role-assignment logic effectively hands attackers control of the authentication gate itself. No public exploit identified at time of analysis, and the issue is reported by Patchstack rather than listed in CISA KEV.
Privilege escalation in Craft CMS before 5.10.11 lets remote attackers gain administrator rights by registering a new account using the email address of a previously deactivated admin, because the admin flag is not validated and persists across registration. Exploitation requires public user registration to be enabled and email verification to be disabled. Reported by VulnCheck with a vendor security advisory (GHSA-242m-9wq7-vhwq); no public exploit identified at time of analysis.
Privilege escalation to administrator in the Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 allows unauthenticated visitors to bypass role restrictions enforced on front-end user registration forms. The plugin fails to validate that a submitted role value matches those actually offered by the configured form, and its blocklist against privileged roles is incomplete, enabling a two-stage attack: register with an elevated role, then escalate that account to full site administrator. A publicly available exploit exists per WPScan disclosure, raising the urgency of patching; no public KEV listing has been identified at time of analysis.
Privilege escalation in the JetBackup WordPress plugin before 3.1.23.5 allows a subscriber-level user to gain full administrator access by exploiting the plugin's failure to validate account roles during a site restore or migration. When the site owner performs a legitimate backup restore or migration, JetBackup blindly preserves and promotes accounts in the backup set without re-verifying their roles or capabilities, silently elevating an attacker's low-privilege account to administrator. A publicly available proof-of-concept exists per WPScan, though no confirmed mass exploitation (CISA KEV) is on record; the CVSS 7.1 score (AC:H/UI:R) reflects real-world complexity imposed by the site-owner trigger.
Unauthenticated privilege escalation in the WordPress plugin Booking for Appointments and Events Calendar - Amelia (Premium) versions 8.0 through 9.6.2 lets remote attackers gain full administrator control of a site. By abusing insufficient validation of the 'type' parameter in the customer update endpoint (with 'externalId' set to 0), an attacker elevates a customer to the manager role, then creates a provider entity linked to an existing administrator and overwrites that administrator's password. No public exploit has been identified at time of analysis, but the CVSS 9.8 rating and unauthenticated network reachability make this a high-priority patch for affected sites.
Authentication bypass in HPE AOS-CX switch operating system allows an adjacent unauthenticated attacker, under high-complexity conditions, to circumvent authentication controls and achieve both integrity compromise and sensitive information exposure. The scope change in the CVSS vector (S:C) indicates successful exploitation can extend impact beyond the directly targeted switch - relevant in networked environments where a compromised switch becomes a pivot point. No public exploit code or CISA KEV listing is present at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WBS) enables network-reachable privilege escalation to full system control on a broad range of Windows client and server releases. An authorized, low-privileged attacker who can induce user interaction can corrupt heap memory in the biometric service process and achieve arbitrary code execution at elevated privilege. Microsoft has released patches addressing all listed affected versions via the MSRC update guide.
Privilege escalation via use-after-free in Windows Credential Providers allows a local, low-privileged authenticated attacker to gain full system control on Windows 11 and Windows Server 2025. The CWE-416 flaw exists in the credential provider subsystem, which handles authentication UI interactions; triggering the UAF condition (AC:H) under the right timing yields C:H/I:H/A:H impact. No public exploit or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches across all affected Windows 11 and Server 2025 builds.
Local privilege escalation in the Windows Device Association Service enables an authenticated low-privileged attacker to gain full SYSTEM-level control via a use-after-free memory corruption flaw. The vulnerability spans Windows 10, Windows 11, and Windows Server 2019 through 2025, representing an extraordinarily broad attack surface across enterprise and consumer environments. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, though the CVSS 7.0 rating reflects realistic difficulty from high attack complexity (AC:H).
Use-after-free in the Windows Hello authentication subsystem on Windows 10 and 11 allows a locally authenticated, low-privileged user to escalate privileges beyond their security boundary. The CVSS scope-change indicator (S:C) confirms that successful exploitation crosses into a more privileged security context - likely SYSTEM or kernel-level - with full confidentiality, integrity, and availability impact. Vendor patch is available via Microsoft's update guide; no public exploit code has been identified at time of analysis.
Stack-based buffer overflow in the Windows Win32K kernel-mode driver enables a low-privileged authenticated attacker to escalate privileges to SYSTEM level via a network-accessible exploit path, affecting 12 distinct Windows releases spanning Windows 10 1809 through Windows Server 2025 and Windows 11 26H1. The CWE-121 flaw resides in the kernel subsystem handling GDI rendering and windowing, making successful exploitation equivalent to full operating system compromise. Microsoft has released patches addressing all affected build ranges; no public exploit code or CISA KEV listing has been identified at time of analysis.
Use-after-free (CWE-416) in the Windows TCP/IP networking stack enables an authenticated, low-privileged attacker to escalate privileges to a higher trust level via a network-based attack path. The vulnerability affects a broad surface - Windows 10 through Windows 11 and Windows Server 2012 through 2025 - making the potential impact wide despite the elevated attack complexity (AC:H) and required user interaction (UI:R) constraints in the CVSS vector. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Use-after-free in the Windows TCP/IP driver allows a network-adjacent low-privileged authenticated attacker to escalate privileges to SYSTEM on affected Windows 10, Windows 11, and Windows Server 2019-2025 installations. The CVSS:3.1 vector (AV:N/AC:H/PR:L/UI:R) indicates exploitation requires high attack complexity and user interaction, consistent with a race-condition-triggered UAF in the kernel networking stack. No public exploit code or CISA KEV entry has been identified at time of analysis, but the broad affected product surface and the Microsoft-origin report make this a priority for enterprise patch cycles.
Privilege escalation in Windows Hello on Windows 11 allows a low-privileged local attacker to gain SYSTEM-level or kernel-level access via a use-after-free memory corruption flaw (CWE-416). Affected builds span all currently supported Windows 11 feature releases (23H2, 24H2, 25H2, and 26H1) prior to Microsoft's July 2026 security update. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the low complexity and absence of required user interaction make this a high-value second-stage escalation primitive.
Use-after-free (UAF) in the Windows Device Association Broker service enables a local, low-privileged authenticated attacker to escalate privileges to SYSTEM or higher on a broad range of Windows 10, Windows 11, and Windows Server releases. The vulnerability (CWE-416) is consistent with a race condition in the Broker's memory management, as reflected by the AC:H metric, and exploitation yields full confidentiality, integrity, and availability impact on the local system. No public exploit code has been identified at time of analysis, but Microsoft has released patches across all affected build streams.
Use-after-free memory corruption in Windows Audio Service enables local privilege escalation across the full Windows ecosystem, from Windows 10 1607 through Windows 11 26H1 and all supported Windows Server releases from 2012 through 2025. The CVSS vector (AV:L/AC:H/PR:L) confirms a locally authenticated attacker must navigate high-complexity exploit conditions - likely a race or timing attack on the audio service's memory lifecycle - before achieving full C:H/I:H/A:H impact, including arbitrary code execution at elevated privilege. No public exploit code has been identified at time of analysis, but Microsoft has released patches for all listed affected builds.
Privilege escalation in Windows Host Guardian Service (HGS) allows a low-privileged local attacker to gain SYSTEM-level access through a use-after-free memory corruption triggered by a race condition. Affected products span Windows 10 and 11 client editions alongside Windows Server 2019, 2022, and 2025, covering a broad enterprise and consumer Windows footprint across multiple build lines. Microsoft has released patches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Windows Accounts Control allows an authorized local attacker to gain elevated system access by exploiting a use-after-free memory corruption flaw (CWE-416). The vulnerability spans a broad range of Windows 10, 11, and Windows Server editions from build 14393 through build 28000, making the exposure surface wide across enterprise and consumer deployments. Microsoft has released patches; no public exploit code or CISA KEV listing exists at time of analysis, though the AC:H vector indicates a race-condition-dependent trigger consistent with timing-sensitive UAF exploitation.
Privilege escalation through a use-after-free condition in the Windows Win32K kernel subsystem allows a low-privileged local attacker to achieve SYSTEM-level access across a wide range of Windows client and server releases, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. The flaw resides in win32k.sys, the kernel-mode driver implementing the Windows graphical subsystem (GDI/USER32), and requires high attack complexity to trigger reliably - consistent with race-condition or heap-grooming exploitation techniques. No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available from Microsoft MSRC.
Privilege escalation in the Windows exFAT File System driver (CWE-125, out-of-bounds read) allows an authenticated low-privilege attacker to gain elevated rights over a network connection. All major Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025 are confirmed affected per EUVD version data. No public exploit or CISA KEV listing was identified at time of analysis, though the broad affected scope across the entire current Windows ecosystem and the high CVSS score of 8.0 make patching urgent.
Privilege escalation in Windows Shell on Windows 11 (versions 23H2 through 26H1) and Windows Server 2025 stems from a use-after-free memory corruption flaw (CWE-416). An authenticated local attacker who triggers the race-condition-sensitive bug can achieve full system compromise with C:H/I:H/A:H impact, yielding effective SYSTEM-level control. No public exploit or CISA KEV listing has been identified at time of analysis; Microsoft has confirmed and patched the issue across all affected builds as documented in EUVD-2026-73549.
Local privilege escalation in Windows Device Association Service exposes all supported Windows client and server editions to full system compromise by a low-privileged local attacker. The root cause is a use-after-free triggered through a race condition (CWE-362): concurrent access to a shared resource in the Device Association Service allows a freed memory object to be reused, enabling controlled code execution in a higher-privilege context. No public exploit or CISA KEV listing is present at time of analysis, but the breadth of affected versions - spanning Windows 10 through Windows 11 26H1 and Windows Server 2012 R2 through 2025 - makes this a high-priority patch for any environment with untrusted local users.
Local privilege escalation in Windows Storage Spaces Controller via a use-after-free memory corruption flaw enables an authenticated low-privilege attacker to gain SYSTEM-level access on affected Windows 10, Windows 11, and Windows Server 2016 through 2025 installations. The vulnerability (CWE-416) exists in the Storage Spaces Controller kernel driver; exploiting it yields full confidentiality, integrity, and availability impact on the local system. No public exploit code or active exploitation confirmed at time of analysis, but the breadth of affected Windows versions makes this a broad-footprint local privilege escalation risk.
Local privilege escalation in the Windows Universal Disk Format File System Driver (UDFS) allows a low-privileged authenticated attacker to gain full control of an affected system through a use-after-free memory corruption condition. The vulnerability spans virtually the entire supported Windows ecosystem, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit identified at time of analysis, and Microsoft has released patches addressing the flaw across all affected builds.
Local privilege escalation in Windows NTFS exposes a use-after-free condition in the kernel-mode filesystem driver, allowing an authenticated local attacker with low privileges to achieve full SYSTEM-level control. The vulnerability spans virtually the entire supported Windows ecosystem - from Server 2012 through Windows 11 26H1 and Windows Server 2025 - making it broadly applicable in enterprise environments. No public exploit or CISA KEV listing has been identified at time of analysis, though the AC:H rating suggests exploitation requires a specific timing or memory-layout condition such as a race condition, limiting opportunistic mass exploitation.
Local privilege escalation in Windows Spaceport.sys, the kernel-mode Storage Spaces driver, allows an authenticated low-privileged local attacker to execute arbitrary code in kernel context, achieving full SYSTEM-level control with no user interaction. The flaw is an out-of-bounds read (CWE-125) in the kernel driver, exploitable across virtually every supported and extended-support Windows release from Server 2012 through Windows 11 26H1 and Server 2025. Microsoft has released patched builds for all affected versions; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Privilege escalation via out-of-bounds read in Windows NTFS affects a broad range of Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. An authorized (low-privilege) network attacker who can trigger specific NTFS parsing behavior - requiring user interaction - can achieve full compromise of confidentiality, integrity, and availability, effectively gaining system-level access. No public exploit has been identified at the time of analysis, but a vendor-released patch is available and should be prioritized given the breadth of affected OS versions.
Privilege escalation in the Windows Win32K kernel-mode GUI subsystem allows a low-privileged local user to gain SYSTEM-level access via a use-after-free memory corruption condition. The vulnerability affects a broad span of Windows 10, Windows 11, and Windows Server 2019/2022/2025 releases, making it highly relevant to enterprise endpoint and server environments. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches across all affected version branches.
Use-after-free in the Windows Human Interface Devices kernel subsystem allows a local, low-privileged user to escalate to SYSTEM-level control. Affecting virtually all current Windows desktop and server releases - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), Windows Server 2016 through 2025 - successful exploitation requires local session access and precise timing but yields full C:H/I:H/A:H kernel impact. No active exploitation has been confirmed (no CISA KEV listing) and no public proof-of-concept is known; Microsoft has released patches for all affected build branches.
Privilege escalation in Microsoft SharePoint Server Subscription Edition enables any authenticated network user to gain elevated privileges with full confidentiality, integrity, and availability impact. The root cause is CWE-250 (Execution with Unnecessary Privileges), where a SharePoint service or component operates with more privilege than its function requires, allowing a low-privileged account to cross privilege boundaries. No active exploitation has been confirmed and no public exploit code has been identified; a vendor patch is available targeting build 16.0.20326.20090.
Use-after-free in Windows Modern Device Management (MDM) enables a low-privileged authenticated attacker to escalate to SYSTEM-level privileges across a broad swath of Windows 10, Windows 11, and Windows Server releases. The CVSS vector (AV:N/AC:H/PR:L/UI:R) indicates the attack is network-reachable but constrained by high exploitation complexity and required user interaction, limiting opportunistic mass exploitation. Microsoft has released patched builds; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation via out-of-bounds read in Windows BitLocker affects a broad swath of Microsoft operating systems from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across multiple feature updates. A low-privileged network-authenticated attacker who can induce user interaction can trigger CWE-125 memory reads beyond buffer boundaries in the BitLocker component, ultimately achieving elevation of privileges with full confidentiality, integrity, and availability impact (CVSS 8.0). No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches addressing all confirmed affected versions.
Local privilege escalation in Windows Error Reporting (WER) across virtually all supported Windows releases exploits an out-of-bounds read (CWE-125) to allow a low-privileged authenticated local user to gain SYSTEM-level access with full confidentiality, integrity, and availability impact. The breadth of affected platforms is significant, spanning Windows 10 versions 1607 through 22H2, Windows 11 versions 23H2 through 26H1, and Windows Server 2012 through Server 2025 including Server Core installations. No public exploit code has been identified at time of analysis, and Microsoft has released patches through the standard Windows Update channel.
Privilege escalation in Windows USB Audio Class driver (usbaudio.sys) allows a local authenticated user to gain SYSTEM-level access via a use-after-free memory corruption condition. Affected versions span the entire supported Windows ecosystem from Server 2012 through Windows 11 26H1 and Windows Server 2025, making patch deployment at scale a significant operational task. No public exploit or CISA KEV listing is confirmed at time of analysis, but the AC:H rating reflects a race-condition exploitation window rather than a trivial trigger, distinguishing this from mass-exploitable LPE bugs.
Local privilege escalation in the Windows TCP/IP stack exploits a race condition (CWE-362) to allow a low-privileged local user to gain full system-level control across virtually every supported Windows release. The vulnerability spans Windows 10 through Windows 11 25H2 and Windows Server 2012 through Server 2025, making the breadth of exposure exceptionally wide. Microsoft has released patches; no public exploit or CISA KEV listing was identified at time of analysis, but the scope of affected systems elevates organizational urgency.
Privilege escalation in Windows Bluetooth Service via a use-after-free (CWE-416) allows a low-privileged local user to achieve full system compromise across a broad range of Windows 10, Windows 11, and Windows Server releases. The CVSS vector (AV:L/AC:H/PR:L) indicates the flaw requires local access and elevated attack complexity - consistent with a race condition in Bluetooth service memory management - but yields full confidentiality, integrity, and availability impact upon successful exploitation. No public exploit code has been identified at time of analysis, and Microsoft has released patches via its regular update channel.
Privilege escalation via use-after-free (CWE-416) in the Windows Kernel enables a network-accessible, low-privileged authenticated user to elevate to SYSTEM privileges across a broad range of Windows client and server releases spanning Windows 10 through Windows 11 26H1 and Windows Server 2012 through 2025. Microsoft has confirmed and released fixed builds for all affected versions via the MSRC advisory. No public exploit code or CISA KEV listing has been identified at time of analysis; the high attack complexity (AC:H) and mandatory user interaction (UI:R) substantially reduce the near-term risk of automated mass exploitation despite the full C:H/I:H/A:H impact triad.
Local privilege escalation in Windows Error Reporting (WER) exploits a use-after-free condition (CWE-416), enabling an authenticated low-privileged attacker to gain SYSTEM-level access on affected Windows systems. The flaw spans a wide range of platforms from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. Microsoft has released patches; no public exploit or CISA KEV listing is present at time of analysis, though the high attack complexity (AC:H) suggests a race condition or timing-dependent exploitation path.
Heap-based buffer overflow in the Win32K kernel subsystem (CWE-122) on Windows 11 and Windows Server 2025 enables a low-privileged local attacker to escalate to SYSTEM-level privileges. Affected builds span Windows 11 24H2, 25H2, and 26H1 as well as Windows Server 2025 and its Server Core variant, per EUVD-2026-73467. Microsoft has released patches addressing all affected versions; no public exploit or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Image Acquisition (WIA) allows an attacker with a low-privilege local account to gain SYSTEM-level access via a use-after-free memory corruption bug. The vulnerability spans nearly every supported Windows release from Server 2012 through Windows 11 26H2, making it a broadly applicable LPE primitive for post-exploitation chains. No public exploit or active exploitation has been identified at time of analysis; Microsoft has released patches through standard monthly update guidance.
Local privilege escalation in Windows Win32K (the kernel-mode graphics subsystem) allows a low-privileged authenticated user to gain SYSTEM-level access by triggering a use-after-free condition. Affected across a wide span of Windows desktop and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. No public exploit code has been identified at time of analysis, and the high attack complexity rating (AC:H) in the CVSS vector suggests reliable exploitation requires precise memory timing or race-condition manipulation.
Privilege escalation in the Windows USB Video Driver allows a locally authenticated attacker to gain SYSTEM-level access by exploiting a race condition in the driver's concurrent execution path. Affecting Windows releases from Server 2012 through Windows 11 26H1 and Windows Server 2025, the flaw (CWE-362) requires low-privilege code execution and tolerates no user interaction, but the high attack complexity reflects the timing window inherent to exploiting a race. No public exploit code or CISA KEV listing has been identified at time of analysis, though Microsoft has released patches across all affected branches.
Privilege escalation to SYSTEM via use-after-free in the Windows Audio Service affects a broad range of Windows 10, 11, and Windows Server versions from 2012 R2 through 2025. An authenticated local attacker can exploit a memory management flaw in the Audio Service to free an object while a reference to it remains live, then redirect execution to gain full C:H/I:H/A:H impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the wide product footprint and low privilege requirement make this a meaningful patching priority.
Privilege escalation via use-after-free in the Windows DNS service affects Windows 10, Windows 11, and Windows Server versions from 2012 R2 through 2025, allowing a locally authenticated low-privileged user to gain SYSTEM-level access. The CWE-416 flaw involves improper memory management in DNS handling routines where freed memory can be accessed and manipulated by an attacker with high-complexity exploitation - consistent with heap-grooming or race-condition prerequisites. Microsoft has released patches across all affected version lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Use-after-free in the Windows Search Component enables an authenticated low-privileged network attacker to elevate privileges, potentially achieving full system compromise (C:H/I:H/A:H). The vulnerability spans virtually the entire modern Windows ecosystem - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making the unpatched population extremely large. Microsoft has released specific patch builds for each affected platform; no public exploit code or CISA KEV listing has been identified at time of analysis, but AC:H and UI:R constrain opportunistic mass exploitation.
Local privilege escalation in Microsoft COM for Windows allows a low-privileged authenticated attacker to gain full SYSTEM-level control via a use-after-free memory corruption flaw. The vulnerability affects a broad range of current Windows client and server releases, from Windows 10 21H2 through Windows 11 25H2 and Windows Server 2022/2025. Microsoft has released patches via the standard update guide; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation via an out-of-bounds read in the Windows USB Driver affects a broad range of Windows client and server editions, enabling a locally authenticated low-privilege attacker to gain full SYSTEM-level control without user interaction. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects low attack complexity with no special setup required beyond a valid local session. No public exploit code or CISA KEV listing has been identified at time of analysis, though the ubiquitous Windows footprint and accessibility of the USB driver to standard user accounts make this a credible post-compromise privilege escalation primitive.
Use-after-free in Windows Remote Desktop Services enables a low-privileged local attacker to escalate privileges to SYSTEM on affected Windows hosts. The vulnerability spans Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, making the attack surface extremely broad across enterprise fleets. No public exploit code or CISA KEV active-exploitation entry has been identified at time of analysis; a vendor-released patch is available.
Local privilege escalation in Windows License Manager exposes authenticated local users to full system compromise via a use-after-free condition (CWE-416). An attacker with a low-privileged local session who can win a memory-management race condition can corrupt heap state and redirect execution to gain SYSTEM-level privileges across a wide range of Windows 10, 11, and Server editions. No active exploitation is confirmed (absent from CISA KEV) and no public exploit code has been identified, but the breadth of affected Windows versions - from Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025 - makes this a meaningful patch priority for multi-user and enterprise Windows environments.
Heap-based buffer overflow in Microsoft Standard XPS (XML Paper Specification), the Windows-integrated document format and print subsystem, enables a low-privileged local user to escalate to SYSTEM or administrator-level privileges across a broad range of Windows desktop and server releases. The flaw falls under CWE-122 and, given AC:L/PR:L/UI:N, requires only an existing standard user session and the ability to trigger XPS processing - no race condition or second-user interaction is needed. Microsoft has released patches for all affected builds; no public exploit code has been identified at time of analysis.
Use-after-free in the Windows Connected User Experiences and Telemetry service (DiagTrack) enables a locally-authenticated low-privileged attacker to escalate privileges to SYSTEM-level access. The vulnerability affects a broad range of current Windows releases - Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2/26H1, Windows Server 2022, and Windows Server 2025 - all receiving patched builds via Microsoft's update cycle. No public exploit code or CISA KEV listing has been identified at time of analysis, but the local privilege-escalation class and high C/I/A impact make this a credible post-compromise escalation path.
Privilege escalation via use-after-free in the Windows File History Service allows a local authenticated attacker to gain full system-level access. The vulnerability affects a wide range of Windows 10, Windows 11, and Windows Server 2016/2019 builds, patched by Microsoft in the corresponding Patch Tuesday update cycle. No public exploit or CISA KEV listing is present at time of analysis, but the High CVSS score (7.0) and C:H/I:H/A:H impact metrics reflect the severity of successful exploitation.
Local privilege escalation in Windows Connected User Experiences and Telemetry (DiagTrack) allows an authenticated local user to elevate to SYSTEM-level privileges by winning a race condition against the SYSTEM-privileged service. The flaw spans Windows 10 21H2/22H2, Windows 11 23H2 through 26H1, Windows Server 2022, and Windows Server 2025, all remediated in the associated Patch Tuesday release. No public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Microsoft SQL Server (versions 2017, 2019, 2022, and 2025) allows a low-privileged authenticated user to elevate their database permissions to a higher role over the network via CWE-269 improper privilege management. With a CVSS 8.8 score and vector AV:N/AC:L/PR:L, the flaw requires only a valid SQL Server login - no attack complexity, no user interaction - and yields full confidentiality, integrity, and availability impact on the database instance. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the near-zero exploitation prerequisites within a widely deployed enterprise platform make urgent patching essential.
Privilege escalation in Microsoft SQL Server allows an authenticated low-privileged network attacker to gain complete control over affected database instances across SQL Server 2017, 2019, 2022, and 2025. The flaw stems from CWE-1220 (Insufficient Granularity of Access Control), where the access control model fails to enforce fine-grained permission boundaries, permitting a standard database login to exceed its intended privilege scope. No active exploitation has been confirmed by CISA KEV and no public proof-of-concept has been identified, but the broad version coverage and full C:H/I:H/A:H CVSS impact make patching urgent. Vendor-released patches are available across all affected release tracks.
Local privilege escalation in Windows Push Notifications affects Windows 10, Windows 11, and Windows Server 2022/2025 via a use-after-free (CWE-416) memory corruption flaw, allowing a low-privileged authenticated local user to obtain SYSTEM-level execution. The vulnerability spans nine distinct Windows release branches - including server editions - broadening the enterprise attack surface. No public exploit code or CISA KEV listing has been identified at time of analysis; however, LPE primitives of this class are routinely integrated into post-initial-access attack chains.
Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows an authenticated local attacker with low privileges to gain SYSTEM-level access via a race condition in kernel-level socket processing. The CVSS vector (AV:L/AC:H/PR:L/UI:N) reflects that exploitation requires an existing low-privilege foothold, precise timing to win the race window, but no user interaction. Microsoft has released patches across a wide range of supported Windows versions. No public exploit or CISA KEV listing has been identified at time of analysis, though race-condition LPE bugs in Windows kernel drivers are a favored post-exploitation technique.
Overly permissive ClusterRole in hawtio-operator amplifies the blast radius of any operator-pod compromise to cluster-wide Secret exposure. The operator's ServiceAccount is granted secrets: [create, get, list, update, watch] across all Kubernetes namespaces with no scope restriction, meaning an attacker who gains code execution in the operator pod can immediately read every Secret in the cluster - bootstrap tokens, cloud provider credentials, and secrets belonging to other operators. No public exploit code has been identified at time of analysis, but the vulnerability is a structural privilege misconfiguration that persists for the lifetime of any deployment running the default ClusterRole.
Privilege escalation in TYPO3 CMS 14.2.0-14.3.6 allows backend administrators without system-maintainer privileges to schedule configuration commands (configuration:set, configuration:show, configuration:read) through the TYPO3 scheduler module, bypassing the role-based authorization that normally restricts these operations to the highest privilege tier. An attacker holding a backend administrator account can leverage this to silently elevate themselves to system-maintainer status or corrupt system configuration to trigger a denial of service. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Privilege escalation in Dell Secure Connect Gateway (SCG) 5.0 allows a local attacker with basic system access to gain full administrative control of the affected host. The root cause is improper privilege management (CWE-269) in both the SCG 5.0 Application (prior to 5.36.00.00) and SCG 5.0 Appliance (prior to 5.36.00.16), as confirmed by Dell advisory DSA-2026-382. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.
Privilege escalation in JetBrains YouTrack before version 2026.2.18634 enables authenticated low-privileged users to alter group memberships without proper server-side authorization validation, effectively granting themselves elevated rights. The flaw (CWE-266, Incorrect Privilege Assignment) means the application trusts client-supplied group membership parameters without enforcing that the requesting user has the authority to make such changes. With a CVSS base score of 8.8 and full C:H/I:H/A:H impact, successful exploitation yields the equivalent of full administrative control over the YouTrack instance.
Privilege escalation in WP Fusion (Pro) for WordPress allows authenticated attackers with Subscriber-level access to create new administrator accounts and achieve full site compromise. The vulnerability resides in the ThriveCart Auto Login handler's `thrivecart()` function, which fails to enforce authorization on the `role` parameter during user account creation, enabling callers to self-assign the `administrator` role. The required access_key is distributed openly to all ThriveCart customers as part of the plugin's documented setup, substantially lowering the practical barrier for anyone who has transacted with the target site's ThriveCart storefront; no public exploit or CISA KEV listing has been identified at time of analysis.
Local privilege escalation to root in Dell Secure Connect Gateway (SCG) 5.0 lets a low-privileged operator with SSH access to the appliance host obtain full root control without a password by abusing the exposed Docker socket (CWE-250, Execution with Unnecessary Privileges). Affected builds are the SCG Appliance prior to 5.36.00.16 and the SCG Application prior to 5.36.00.00. The same socket exposure also enables container escape: an attacker who compromises any service inside the orchestrator container can break out to host-level control. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the technique (writable/accessible Docker socket) is a well-known and reliable escalation path.
Local privilege escalation in Dell Secure Connect Gateway 5.0 enables a low-privileged authenticated user with local shell access to gain elevated - likely root or administrator-level - control of the affected host. Both the virtual appliance (prior to 5.36.00.16) and standalone application (prior to 5.36.00.00) deployments are affected, as confirmed by Dell advisory DSA-2026-382. No public exploit code or active exploitation has been identified, and vendor-released patches are available for both product variants.
Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset variants via a heap-based out-of-bounds write stemming from a missing bounds check (CWE-122). An unprivileged local process on any affected device can trigger the flaw to achieve full kernel-level read, write, and execute access without requiring any user interaction. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the sheer breadth of affected chipsets across MediaTek's mid-range and budget device portfolio makes systematic patch deployment a significant supply-chain challenge.
Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged attacker to escalate privileges to kernel level with full system compromise. The CVSS vector (AV:L/AC:L/PR:N/UI:N) reflects that any Android app running on an affected device can trigger this flaw without special permissions or user interaction, consistent with typical Android kernel driver exposure. SSVC rates exploitation as 'none' and the attack as non-automatable, though technical impact is assessed as total; no public exploit or CISA KEV entry exists at time of analysis.
Authorization bypass in MISP's UiBeta theme collection view exposes full event details - including identifiers, info fields, timestamps, creator organization, all event tags, and galaxy clusters - to authenticated users who lack ACL permissions to those events. The UiBeta theme's `view.ctp` template performed an independent secondary database query using only `Event.uuid IN (...)` without invoking `createEventConditions()`, the canonical per-user ACL enforcement method, even though `CollectionsController::view()` correctly filtered events via `Event::fetchSimpleEvents($user, ...)`. The flaw is compounded because `CollectionElementsController::add()` accepts arbitrary UUIDs from collection owners without validating the submitter's authorization against the referenced event, making collection elements an attacker-controlled input to an unfiltered query. No public exploit code has been identified at time of analysis and no CISA KEV listing exists.
Account takeover via insecure direct object reference in the SureCart WordPress plugin (versions 4.0.0 through 4.6.2) allows any subscriber-level authenticated user to seize full control of an administrator account. The plugin's customer update endpoint validates that the requester has permission to update customers, but fails to verify that the target customer record belongs to the requesting user - enabling arbitrary cross-user email modification followed by a password reset. A compounding information disclosure flaw leaks customer identifiers and email addresses to all authenticated users, providing the enumeration primitive needed to complete the takeover chain without any additional knowledge. A publicly available proof-of-concept exploit exists, and vendor patch 4.6.3 is available.
Improper privilege management in the Tenda CP3 IP camera (firmware 27.5.57.101) exposes the CRedirServer::SetRedirectEnable function (Functions/Redirect.cpp) to remote abuse, letting an attacker toggle the device's redirect handling without proper authorization enforcement. The flaw was disclosed by VulDB (vuln #399276) and carries a CVSS 4.0 base score of 9.4, though no public exploit code and no active-exploitation evidence accompany the entry. No public exploit identified at time of analysis, and the single-source, sparse disclosure limits how much of the claimed impact can be independently confirmed.
Privilege escalation in MikroTik RouterOS lets a remote, unauthenticated attacker abuse the SSH login helper to rewrite the trusted RouterOS policy mask by supplying a username that begins with a prohibited character. Because the flaw is reached before authentication completes, an attacker who can open an SSH session to an affected device can escalate to full administrative privileges. Publicly available exploit code exists, and CERT-PL (the reporter) has published a companion advisory describing these RouterOS issues as actively exploited, though the CVE is not confirmed on CISA KEV in the provided data.
Privilege escalation in grav-plugin-api before 1.0.20 allows a low-privileged API manager to self-create a super-admin account by exploiting a logic gap in the InvitationsController's stripSuperFlags() method, which strips nested super flags but ignores dot-keyed equivalents such as 'api.super'. The attacker crafts an invitation payload containing the dot-keyed flag, which persists through sanitization into the new account, then self-accepts the invitation via the public acceptance endpoint - no real invitee participation required - and immediately receives a valid JWT granting full Grav site control. No public exploit or CISA KEV listing is present at time of analysis, but the attack is fully self-contained and conceptually trivial for any account already holding api.users.write permissions.
Privilege escalation in the Abandoned Cart Pro for WooCommerce WordPress plugin (all versions through 10.7.1) allows authenticated subscribers to gain full WordPress administrative access by hijacking the plugin's SMTP email routing. Missing capability checks and nonce verification on at least four AJAX endpoints - including wcap_save_connector_settings - permit any subscriber-level user to silently redirect outbound SMTP traffic through an attacker-controlled mail server. Once SMTP is redirected, the attacker intercepts auto-login recovery links sent to administrators and authenticates as admin without any further credentials. No public exploit has been identified at time of analysis, but the attack exploits a default-enabled feature, significantly lowering the bar for abuse on any standard installation.
Site takeover in the SEO Flow by LupsOnline WordPress plugin (versions 3.0.0 through before 3.0.3) stems from improper validation of the credential supplied with the plugin's API requests, allowing unauthenticated attackers to be served in the security context of the administrator who configured the plugin. Because the flaw grants effective administrator-level access, an attacker can fully compromise the affected WordPress site. Publicly available exploit code exists (published by WPScan), though EPSS remains low at 0.15% (4th percentile), and there is no public exploit identified as active in the wild.
Privilege escalation in Inductive Automation Ignition 8.1.53 and earlier allows any authenticated user who can execute gateway scripts to create SCADA/HMI projects without restriction, because the Gateway 'Create Project Role(s)' setting shipped with a blank default - effectively disabling the access control gate entirely. In industrial control system (ICS) environments, unauthorized project creation is operationally significant: projects define the logic, tags, and screens that interact with physical process equipment. Ignition 8.1.54 closes the gap by restricting project creation to Designer sessions, removing reliance on the misconfigured role setting. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Privilege escalation in PassMark's shared DirectIo64.sys kernel driver, bundled with PerformanceTest (before 11.1 build 1012), BurnInTest (before 11.1 build 1000), and OSForensics (before 11.1 build 1016), allows any low-privileged local user to gain complete hardware-level control over the host. The driver exposes IOCTLs without validating the target device, register offset, or value, enabling arbitrary PCI configuration space reads and writes. An attacker can leverage this to enable Bus Master DMA on any PCI device, remap Base Address Registers to attacker-controlled physical memory addresses, or halt storage controller I/O - all without kernel exploits. A public proof-of-concept is available; no active exploitation (CISA KEV) confirmed at time of analysis.
Local privilege escalation in Acunetix 25.11.251107123 for Windows enables low-privileged local users to execute arbitrary code as SYSTEM by exploiting CWE-427 (Uncontrolled Search Path Element) in the wvsc.exe Web Vulnerability Scanning Engine. The SYSTEM-level wvsc.exe process searches for OpenSSL-related files at a hardcoded directory path that does not exist by default; an attacker creates the missing directory and plants a malicious file, which the service subsequently loads and executes, yielding full SYSTEM-level control. A public proof-of-concept is available via the Full Disclosure mailing list and corroborated by a VulnCheck advisory, making this trivially reproducible by any local user on affected Windows installations.
Local privilege escalation in JAL Information Technology's Pallet Control suite (including PalletControl and PalletControl Cloud) enables a low-privileged local attacker to execute arbitrary code with SYSTEM-level privileges due to incorrect default installation permissions (CWE-276). All tracked versions across three CPE entries are listed as affected per JPCERT/CC coordination notice JVN#84094853. No public exploit code has been identified at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog.
Unauthenticated account takeover in the ACPT (Premium) WordPress plugin (versions up to and including 2.0.66) lets remote attackers hijack any account, including administrators. The plugin's submit() handler processes anonymous form submissions without verifying that the submitter is authorized to modify the targeted user, then passes an attacker-controlled user ID to wp_update_user(), allowing the attacker to overwrite that user's email address and password. Reported by Wordfence; no public exploit and no CISA KEV listing at time of analysis, but the CVSS 9.8 rating reflects a trivially weaponizable full-compromise path where a vulnerable form is exposed.
Account takeover in slimkit ThinkSNS+ v2.4 allows a remote unauthenticated attacker to hijack arbitrary user accounts by abusing the password-reset flow, where the ResetPasswordController.php component continues to accept verification codes after they should have expired. Because expired codes remain valid (enabling reuse/replay of a code well past its lifetime), an attacker can complete a password reset for a targeted account and gain full control. No public exploit code is confirmed, though a detailed technical writeup exists; EPSS is low (0.21%) and the issue is not on CISA KEV.
Privilege escalation on MBS-Solutions X-Serie Gateway firmware V6_00_05 allows an authenticated low-privileged service user to gain full root access on the device. The firmware grants passwordless sudo execution of /usr/bin/tcpdump as root; by supplying the -z post-rotate flag, the attacker triggers execution of an arbitrary command with root privileges, achieving complete system compromise. A public proof-of-concept is available via the researcher's GitHub repository; no CISA KEV listing has been identified at time of analysis.
Privilege escalation in MBS-solutions X-Serie Gateway firmware V6_00_05 allows a remote attacker to gain elevated privileges by abusing two CGI endpoints, /cgi-bin/wwwugw.cgi and /cgi-bin/ugwdownload.cgi. Per the CVSS vector the attack requires no authentication (PR:N) and yields high confidentiality and integrity impact, effectively granting an attacker administrative control over the gateway's configuration and data. A public write-up and proof-of-concept exist in a GitHub research repository, though there is no evidence of active exploitation.
Privilege escalation in Kibana's Fleet management component allows any user holding Fleet management privileges to mint arbitrarily elevated Elasticsearch cluster credentials - up to full cluster administration - for every Elastic Agent enrolled in a targeted policy. Elasticsearch cluster privilege declarations sourced from integration packages were not validated before being used to generate agent credentials (CWE-863: Incorrect Authorization), enabling an attacker to inject overprivileged credentials across an entire agent fleet. No public exploit has been identified at time of analysis, and CISA KEV status is not confirmed, but the impact is laterally broad: a single privileged user can compromise all agents and the Elasticsearch cluster they authenticate to.
Local privilege escalation in HP Support Assistant (versions prior to 9.53.2.0) allows a low-privileged local user to gain elevated system privileges by exploiting insufficient granularity in access controls (CWE-1220). The vulnerability requires local authenticated access but no user interaction, and the CVSS 4.0 AT:P metric indicates specific attack conditions must be present. No public exploit code or active exploitation has been identified at time of analysis; HP has released a patched version addressing the issue.
Privilege escalation in the Bricksforge WordPress plugin (versions <= 3.1.8.8) lets a low-privileged user elevate their account to higher-privileged roles, per a Patchstack advisory. The flaw (CWE-266, Incorrect Privilege Assignment) carries a CVSS of 9.8 with a network/no-auth vector, though the 'Subscriber Privilege Escalation' label implies a logged-in subscriber account is the realistic starting point. No public exploit code, KEV listing, or EPSS score was provided at time of analysis.
Subscriber-level privilege escalation in WCFM Membership WordPress plugin (versions ≤ 2.11.11) enables any authenticated user holding a basic subscriber account to elevate their role to a higher-privileged level, producing high-integrity impact on the affected WordPress/WooCommerce installation. The flaw falls under CWE-266 (Incorrect Privilege Assignment) and was responsibly disclosed by Patchstack. No public exploit code or active exploitation has been identified at time of analysis, though the low attack complexity and broad attacker pool (any registered subscriber) make this a realistic threat for multivendor marketplace deployments.
Improper authentication in Adobe ColdFusion 2023 and 2025 allows unauthenticated adjacent-network attackers to escalate privileges and gain limited read and write access to affected systems. The vulnerable administrative component is network-restricted by default, which partially contains exposure, but the scope change indicator in the CVSS vector signals that successful exploitation can affect components beyond the directly targeted service. No public exploit code or CISA KEV listing has been identified at time of analysis.
Full account takeover in WWBN AVideo arises because the video_id_hash acts as a non-expiring, non-revocable bearer token that authenticates the holder as the video owner with complete administrator privileges. Any attacker who obtains a valid video_id_hash can replay it indefinitely to gain full admin session access, and the credential keeps working even after the victim rotates their password - eliminating the primary recovery mechanism. Reported by VulnCheck with a fix in the vendor GitHub Security Advisory; no public exploit identified at time of analysis, and no EPSS or KEV data was provided.
Privilege escalation in util-linux through versions 2.41.5 and 2.42.2 allows local low-privilege users to execute privileged post-mount hook operations on pre-existing filesystems by exploiting libmount's failure to validate mount helper exit status before dispatching the MOUNT_POST stage. The root cause - captured by CWE-390 - lies in context_mount.c functions mnt_context_do_mount() and mnt_context_mount(), which gate post-mount hook execution solely on a zero result code without verifying whether the underlying mount helper or kernel syscall actually succeeded. No public exploit code has been identified at time of analysis, but the public GHSA advisory and three upstream patch commits provide sufficient technical detail to support independent exploit development.
Local privilege escalation in Elastic Agent on Windows enables a low-privileged local user to achieve SYSTEM-level code execution by exploiting overly permissive access controls (CWE-732) on resources created during unprivileged-mode installation. The agent service, running as SYSTEM, will execute attacker-controlled binaries placed via the CAPEC-642 binary replacement technique. Vendor-released patches 8.19.21, 9.4.6, and 9.5.2 are available per advisory ESA-2026-150; no public exploit identified at time of analysis.
Privilege escalation in the LiquidThemes Booking Hub WordPress plugin (≤1.3.1) allows authenticated low-privileged users to incorrectly assign themselves or others elevated WordPress roles, up to and including administrator. The flaw stems from CWE-266 (Incorrect Privilege Assignment) - the plugin fails to enforce proper capability checks before processing role or privilege assignment operations. CVSS 8.8 (PR:L) confirms exploitation requires an existing low-privilege account; no public exploit code or CISA KEV listing identified at time of analysis.
Unauthenticated privilege escalation in the WordPress Authorizer plugin (versions 3.15.1 and earlier) lets remote attackers with no credentials elevate themselves to elevated/administrative roles, according to a CVSS 9.8 rating and CWE-266 (incorrect privilege assignment). Authorizer is an authentication/SSO plugin, so a flaw in its role-assignment logic effectively hands attackers control of the authentication gate itself. No public exploit identified at time of analysis, and the issue is reported by Patchstack rather than listed in CISA KEV.
Privilege escalation in Craft CMS before 5.10.11 lets remote attackers gain administrator rights by registering a new account using the email address of a previously deactivated admin, because the admin flag is not validated and persists across registration. Exploitation requires public user registration to be enabled and email verification to be disabled. Reported by VulnCheck with a vendor security advisory (GHSA-242m-9wq7-vhwq); no public exploit identified at time of analysis.
Privilege escalation to administrator in the Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 allows unauthenticated visitors to bypass role restrictions enforced on front-end user registration forms. The plugin fails to validate that a submitted role value matches those actually offered by the configured form, and its blocklist against privileged roles is incomplete, enabling a two-stage attack: register with an elevated role, then escalate that account to full site administrator. A publicly available exploit exists per WPScan disclosure, raising the urgency of patching; no public KEV listing has been identified at time of analysis.
Privilege escalation in the JetBackup WordPress plugin before 3.1.23.5 allows a subscriber-level user to gain full administrator access by exploiting the plugin's failure to validate account roles during a site restore or migration. When the site owner performs a legitimate backup restore or migration, JetBackup blindly preserves and promotes accounts in the backup set without re-verifying their roles or capabilities, silently elevating an attacker's low-privilege account to administrator. A publicly available proof-of-concept exists per WPScan, though no confirmed mass exploitation (CISA KEV) is on record; the CVSS 7.1 score (AC:H/UI:R) reflects real-world complexity imposed by the site-owner trigger.
Unauthenticated privilege escalation in the WordPress plugin Booking for Appointments and Events Calendar - Amelia (Premium) versions 8.0 through 9.6.2 lets remote attackers gain full administrator control of a site. By abusing insufficient validation of the 'type' parameter in the customer update endpoint (with 'externalId' set to 0), an attacker elevates a customer to the manager role, then creates a provider entity linked to an existing administrator and overwrites that administrator's password. No public exploit has been identified at time of analysis, but the CVSS 9.8 rating and unauthenticated network reachability make this a high-priority patch for affected sites.
Authentication bypass in HPE AOS-CX switch operating system allows an adjacent unauthenticated attacker, under high-complexity conditions, to circumvent authentication controls and achieve both integrity compromise and sensitive information exposure. The scope change in the CVSS vector (S:C) indicates successful exploitation can extend impact beyond the directly targeted switch - relevant in networked environments where a compromised switch becomes a pivot point. No public exploit code or CISA KEV listing is present at time of analysis.