CVE-2026-47648: Windows Storage Elevation of Privilege Vulnerability

Synopsis

An untrusted search path vulnerability in the Windows Storage component allows a locally authenticated attacker to elevate privileges on affected Windows 10 and Windows 11 systems. The attacker needs an existing low-privilege account and local access; no network exposure is required. Successful exploitation gives the attacker full control over the host, including read, write, and availability impact at the system level. Patched-image rebuilds at the fix versions are available on HarborGuard for environments running affected Windows base images.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the service is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient; the attacker does not need administrative or elevated credentials to begin the attack.

• Victim interactionNot required

  No user interaction is needed; the attacker can execute the exploit entirely without involvement from another user.

• Attack complexityDetail

  Exploitation is rated High complexity, meaning the attacker must meet specific environmental conditions or timing constraints, such as race conditions or a particular process state, before the exploit succeeds reliably.

Blast Radius

• A successful attacker reads protected files, credentials, and other high-confidentiality data stored on the local system.
• The attacker writes to or modifies protected system files and persisted data, including registry keys and storage-layer objects.
• The attacker can crash or render unavailable the affected storage subsystem or dependent services on the host.