CVE-2026-42829: Windows 11 Administrator Protection Bypass (CVSS 7.8 HIGH)

Technical summary

This vulnerability stems from inadequate access control enforcement in Windows Administrator Protection (CWE-284: Improper Access Control). The flaw allows a locally authenticated, low-privileged process to circumvent the protective mechanisms that normally isolate and restrict administrative function calls. The attack vector is local (AV:L), requires low attack complexity (AC:L), and necessitates low privileges (PR:L) to trigger. No user interaction is required (UI:N), and the impact is confined to the local system (S:U). Successful exploitation results in confidentiality, integrity, and availability compromise (C:H/I:H/A:H), enabling an attacker to execute arbitrary operations with SYSTEM-level rights.

Business impact

This vulnerability directly threatens the security posture of organizations deploying Windows 11 across the affected versions. Any user account with login credentials—including contractors, temporary staff, or compromised low-privilege accounts—can escalate to full administrative control. This enables lateral movement within the system, installation of backdoors, exfiltration of sensitive data, ransomware deployment, or denial of service. Organizations managing large Windows 11 fleets face heightened risk of insider threats and post-compromise persistence if the vulnerability remains unpatched.

Affected systems

The vulnerability affects Windows 11 across three update tracks: 24H2, 25H2, and 26H1. Organizations must verify their specific installed versions and build numbers against the vendor advisory to determine which systems in their environment require remediation. The broad impact across multiple recent update versions suggests Windows 11 deployments across a wide range of enterprises are potentially vulnerable.

Exploitability

Exploitability is rated as moderate to high. The vulnerability requires an attacker to have already obtained local system access and valid credentials—a meaningful barrier. However, once these prerequisites are met, exploitation is straightforward and does not require user interaction, timing, or sophisticated techniques. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting widespread active exploitation has not yet been documented at publication. Nevertheless, the accessibility of the attack (low complexity, low privilege required) means exploitation is practical and likely to be attempted once the technical details circulate.

Remediation

Apply the latest security updates from Microsoft for Windows 11 as soon as they become available. Verify that your patched build addresses the specific vulnerability identifier CVE-2026-42829. Organizations should prioritize systems with high-risk user populations (shared workstations, developer machines, contractor access) and systems handling sensitive data. Additionally, enforce principle of least privilege by auditing and revoking unnecessary administrative rights from user accounts. Consider implementing application whitelisting or Windows Sandbox to contain the blast radius of potential privilege escalation.

Patch guidance

Check the Microsoft Security Updates page and your organization's patch management system for Windows 11 cumulative updates released on or after June 17, 2026 (the vulnerability's last modification date). Verify the KB article number and build version in the advisory before deployment. Test patches in a non-production environment first, particularly if your organization relies on specialized drivers or legacy applications. Deploy patches to vulnerable systems according to your change management process, prioritizing business-critical and user-facing systems first.

Detection guidance

Monitor system logs for unusual process elevation attempts, particularly from low-privileged user sessions invoking administrative functions or services. Windows Defender for Endpoint users should enable detection rules for privilege escalation via Administrator Protection bypass. Review access control lists (ACLs) on protected administrative resources for unexpected modifications. Audit logon events and privilege use logs for suspicious patterns, such as the same user account repeatedly attempting and then succeeding at administrative actions. Network detection is limited since the vulnerability is locally exploited, but monitor for post-exploitation indicators such as unexpected SYSTEM-context child processes spawned from user sessions.

Why prioritize this

This vulnerability merits HIGH priority remediation. The combination of a 7.8 CVSS score, broad Windows 11 platform coverage, low barrier to exploitation (once local access is obtained), and the criticality of the compromised security boundary (Administrator Protection) creates significant organizational risk. Although KEV status is not yet active, the technical accessibility of the exploit means it is likely to be prioritized by attackers. Any organization with Windows 11 deployments should treat this as a near-term patching objective.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects a local attack vector requiring authentication, but with complete system compromise as the outcome. The score appropriately captures that while an attacker needs valid credentials and system access, the impact is severe once those prerequisites are met. For organizations with stringent access controls and privileged account monitoring, the contextual risk may be moderated; however, for organizations with numerous low-privileged users or shared workstations, the risk approaches critical. The absence of complexity in the attack (AC:L) and the fact that no user interaction is required further elevate the practical risk.

Frequently asked questions