CVE-2026-42902: Microsoft PowerToys Elevation of Privilege Vulnerability

Synopsis

An improper authorization vulnerability in Microsoft PowerToys allows a local attacker with a standard user account to elevate their privileges on the affected system. The attack requires only local access and a low-privilege account; no network exposure or victim interaction is needed. Successful exploitation grants the attacker high-level control over confidentiality, integrity, and availability of the system. A patched-image rebuild at v0.99.1 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the service is required.

• AuthenticationRequired

  A low-privilege local account is sufficient; any standard user credential satisfies this requirement.

• Victim interactionNot required

  No action from another user or administrator is needed to trigger the vulnerability.

• Attack complexityDetail

  The exploit is reliable and condition-free, with no race conditions or environmental factors that the attacker must manipulate.

Blast Radius

• The attacker reads files, credentials, or secrets that are restricted to higher-privilege accounts on the host.
• The attacker modifies system files, configurations, or persisted data beyond the scope of their original user account.
• The attacker crashes or disrupts services running on the host, including those owned by other users or the operating system.
• Combined control over confidentiality, integrity, and availability gives the attacker effective full-system compromise from a standard user starting point.