CVE-2026-42902: Microsoft PowerToys Privilege Escalation Vulnerability (CVSS 7.8)

Technical summary

CVE-2026-42902 is a privilege escalation vulnerability stemming from improper authorization controls (CWE-285) in Microsoft PowerToys. The flaw permits an authenticated local attacker to elevate privileges without requiring user interaction. The CVSS 3.1 score of 7.8 (HIGH) reflects the combination of local attack vector, low attack complexity, low privilege requirement, and the ability to compromise confidentiality, integrity, and availability. The vulnerability does not yet appear on CISA's Known Exploited Vulnerabilities catalog, indicating limited evidence of active exploitation at the time of publication.

Business impact

Privilege escalation vulnerabilities in widely-used administrative tools like PowerToys pose a lateral movement and persistence risk. An insider, compromised account, or attacker with initial low-privileged access can use this flaw to move toward system administration rights, enabling deployment of malware, data exfiltration, or system-wide compromise. Organizations using PowerToys in standardized deployments or shared lab environments face elevated risk, particularly in zero-trust architectures that depend on privilege boundaries.

Affected systems

Microsoft PowerToys is targeted by this vulnerability. The flaw affects systems on which PowerToys is installed and allows an authenticated local user to escalate privileges. The vulnerability requires an attacker to already possess valid local credentials, meaning exposure is primarily internal—staff accounts, shared systems, or compromised user sessions are the likely attack vectors.

Exploitability

Exploitation requires local access and pre-existing user-level credentials; it is not remotely exploitable. Attack complexity is low, meaning an attacker with the necessary baseline access can trigger privilege escalation without significant technical barriers or user interaction. The absence of a KEV listing suggests active exploitation has not yet been widely observed in the wild, though the low barriers to exploitation mean this status may change as awareness increases.

Remediation

Apply the security update from Microsoft addressing CVE-2026-42902. Verify against the official Microsoft advisory or security update page for the specific patch version and applicable PowerToys release lines. Organizations should prioritize patching systems where PowerToys is deployed in multi-user, shared-access, or elevated-trust contexts. Restrict PowerToys installation to systems where its functionality is genuinely required, and consider limiting installation to administrative users only.

Patch guidance

Consult the Microsoft security advisory and the PowerToys GitHub repository for available updates. Prioritize patching in environments where multiple user accounts access shared systems or where PowerToys is used in privileged contexts. Test patches in a non-production environment to confirm compatibility with organizational workflows. For large deployments, use group policy or mobile device management (MDM) solutions to enforce updates across the fleet.

Detection guidance

Monitor system logs for unexpected privilege escalation events, particularly those originating from PowerToys processes. Audit user account privilege changes, especially from standard to administrative rights. Endpoint detection and response (EDR) tools should flag suspicious process execution chains involving PowerToys components followed by privilege escalation API calls. Track PowerToys version numbers across deployed systems to identify unpatched instances.

Why prioritize this

This vulnerability warrants HIGH priority because it enables local privilege escalation with low attack complexity and minimal user interaction. Although it requires pre-existing credentials, the transition from user-level to system-level access significantly increases the impact of any prior compromise. In zero-trust and least-privilege architectures, closure of privilege escalation vectors is critical to maintaining security boundaries.

Risk score, explained

The CVSS 3.1 score of 7.8 reflects a local attack vector (AV:L), low attack complexity (AC:L), and a requirement for low-level privileges (PR:L). The impact is severe: an attacker gains high-level access to confidentiality, integrity, and availability of the affected system (C:H/I:H/A:H). The unchanged scope (S:U) means the attack does not cross security boundaries beyond the targeted system. This rating appropriately captures the privilege escalation risk in a local context while acknowledging the authentication prerequisite.

Frequently asked questions