CVE-2026-26184 Microsoft CVE debrief

Who should care

System administrators and security teams responsible for Windows systems, especially those with elevated privileges or high-risk configurations, should prioritize patching and monitoring.

Why it matters

CVE-2026-26184 is a high-severity elevation of privilege vulnerability in the Windows Projected File System. An authorized attacker can exploit this vulnerability locally to gain elevated privileges. Multiple Windows versions are affected, including Windows 10, Windows 11, and Windows Server. Microsoft has released patches for these vulnerabilities, and system administrators should prioritize patching and monitoring to prevent potential exploitation.

• Verify patch deployment for affected Windows versions to prevent privilege escalation
• Monitor system configurations for potential exploitation attempts
• Prioritize patching for high-risk systems and those with elevated privileges
• Assess exposure and implement compensating controls if patches cannot be applied immediately

Technical summary

The Windows Projected File System has a buffer over-read vulnerability, allowing an authorized attacker to elevate privileges locally. This affects multiple Windows versions, including Windows 10 Version 1809, Windows 10 Version 21H2, Windows 10 Version 22H2, Windows 11 version 23H2, Windows 11 Version 23H2, Windows 11 Version 24H2, Windows 11 Version 25H2, Windows 11 version 26H1, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows Server 2022, 23H2 Edition (Server Core installation), Windows Server 2025, and Windows Server 2025 (Server Core installation).

Defensive priority

Apply patches immediately for affected Windows versions, especially for high-risk systems.

Recommended defensive actions

• Apply patches for affected Windows 10, Windows 11, and Windows Server versions
• Prioritize patching for high-risk systems and those with elevated privileges
• Verify system configurations and monitor for potential exploitation attempts

Evidence notes

The CVE record and Microsoft's advisory provide details on the vulnerability and affected systems. The vulnerability has a high CVSS score of 7.8 and is classified as HIGH severity. Multiple sources, including the CVE Program and NIST NVD, confirm the vulnerability and provide additional information on the affected systems and potential impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.