CVE-2026-42989: Winlogon Elevation of Privilege Vulnerability

Synopsis

A link-following privilege escalation vulnerability exists in Winlogon, the Windows authentication and session management component, affecting multiple versions of Windows 10 and Windows 11. The vulnerability is reached locally and requires only a low-privilege account, with no user interaction needed. Successful exploitation gives an attacker full read, write, and control over the affected system. Patched-image rebuilds at the applicable fix versions are available on HarborGuard for environments running an affected Windows base image.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network exposure is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient; no administrative credentials are needed to trigger the vulnerability.

• Victim interactionNot required

  The exploit executes without requiring any action from another user on the system.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions or special environmental factors need to align.

Blast Radius

• Reads any file or credential material on the system, including stored secrets, hashes, and configuration data accessible to SYSTEM.
• Modifies or overwrites any file on the local filesystem, including security-critical binaries and audit logs.
• Terminates or disrupts any running process, including security tooling and endpoint agents.
• Achieves full local SYSTEM-level control, enabling persistence mechanisms such as service installation or scheduled task creation.