CVE-2026-42829: Windows Administrator Protection Secure Feature Bypass Vulnerability

Synopsis

An improper access control flaw in Windows Administrator Protection allows a local attacker to bypass a security feature that is intended to restrict privilege elevation. The vulnerability is reached locally and requires only a low-privilege account, with no victim interaction needed, as indicated by the CVSS vector (AV:L/PR:L/UI:N). Successful exploitation gives the attacker full read, write, and availability impact on the system, effectively granting them control equivalent to an administrator. Patched-image rebuilds at versions 10.0.26100.8655, 10.0.26200.8655, and 10.0.28000.2269 are available on HarborGuard for affected environments running Windows 11 24H2, 25H2, or 26H1.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the target is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient; the attacker does not need administrator or elevated credentials to trigger the bypass.

• Victim interactionNot required

  No user action or social engineering is needed; the attacker can execute the exploit entirely on their own.

• Attack complexityDetail

  The exploit is reliable and condition-free, with no race conditions or special environmental setup required (AC:L).

Blast Radius

• Reads files, secrets, and credentials that are restricted to administrator-level accounts on the host.
• Modifies or overwrites system files, registry keys, and security configurations protected by Administrator Protection.
• Disrupts or terminates processes and services that require elevated privileges to manage.
• Effectively grants full administrative control over the compromised Windows 11 instance.