CVE-2026-49161: Microsoft PC Manager Security Feature Bypass Vulnerability

Synopsis

This is a security feature bypass vulnerability caused by improper access control in Microsoft PC Manager. The vulnerability is exploited locally by an attacker who already holds a low-privilege account on the affected machine, requiring no interaction from another user. Successful exploitation gives the attacker high-confidentiality, high-integrity, and high-availability impact on the affected system, enabling full read access to sensitive data, modification of files or state, and disruption of the application. A patched-image rebuild at version 3.21.6.0 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the target is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient; the attacker does not need administrative credentials.

• Victim interactionNot required

  No action from another user is needed; the attacker executes the exploit entirely on their own.

• Attack complexityDetail

  The exploit is reliable and condition-free, requiring no race conditions, memory-layout knowledge, or special environmental setup.

Blast Radius

• Reads sensitive files, credentials, or application data accessible on the host.
• Modifies files, configuration, or application state on the affected system.
• Crashes or disrupts the Microsoft PC Manager process and any dependent functionality.
• Bypasses the security controls Microsoft PC Manager enforces, potentially exposing the host to further attack vectors.