CVE-2026-45586

This vulnerability is like a doorway that has multiple paths, and the building guard sometimes checks the wrong path before letting someone in. If an attacker already has a legitimate foothold on the computer, they can abuse Windows’ Collaborative Translation Framework to get higher permissions than they should. In plain terms: it helps a local attacker “level up” their access.

This matters to you if you use or run Microsoft Windows on workstations or servers, especially: microsoft windows 10 1607, microsoft windows 10 1809, microsoft windows 10 21h2, microsoft windows 10 22h2, microsoft windows 11 23h2, microsoft windows 11 24h2, microsoft windows 11 25h2, microsoft windows 11 26h1, microsoft windows server 2012, and microsoft windows server 2016. Because the issue is local and requires an attacker to already be able to act on the machine, it’s most relevant for devices that may be reachable through user accounts, remote access, or other compromise paths.

This is RED urgency because it is being exploited in the wild (“itw”) and has had sustained press attention tied to patching. Even though there’s no known public exploit and no CISA KEV entry, attackers are already using it against real systems, so waiting increases your odds of being the next victim. Act as soon as possible, not “later this quarter.”

1. Identify exposure: Confirm which machines run microsoft windows 10 1607, microsoft windows 10 1809, microsoft windows 10 21h2, microsoft windows 10 22h2, microsoft windows 11 23h2, microsoft windows 11 24h2, microsoft windows 11 25h2, microsoft windows 11 26h1, microsoft windows server 2012, and microsoft windows server 2016. 2) Patch promptly: Install the vendor security update that addresses CVE-2026-45586 on each affected system. Validate patch installation (your IT person can check the OS build and applied update list). 3) Reduce attack surface temporarily (if patching is delayed): limit remote logins, tighten access to accounts on those machines, and isolate the hosts from networks where possible until updates are complete. 4) Monitoring after updates: Since this is already exploited in the wild, review security logs for signs of local compromise leading up to privilege changes—look for unexpected behavior from user sessions, unusual process activity, and any evidence that a lower-privileged user suddenly gained higher privileges. 5) Incident readiness: If you suspect any compromise, treat this as urgent containment—preserve logs, reset credentials if needed, and consider a broader security review beyond this single CVE.

Severity is rated HIGH (CVSS 7.8) and the issue is tracked as CVE-2026-45586. The provided context says exploitation status is “itw” (exploited in the wild) and mentions named actor “Nightmare Eclipse (aka Chaotic Eclipse, MSNightmare)” with sustained press attention focused on patching. The weakness is improper link resolution before file access (link following) in Windows Collaborative Translation Framework, enabling an authorized attacker to elevate privileges locally. Attack vector (per provided description): local privilege escalation after an attacker has obtained authorization on the machine. EPSS is 2.2% estimated probability of exploitation in the next 30 days, which is relatively low, but the “itw” status and sustained targeting drive the RED urgency. CISA KEV lists “no” here, and there is no public exploit, no Nuclei detection template, and no known public exploit availability in the provided context—however, exploitation is still reported as active. (EPSS: an estimate of likelihood; KEV: CISA’s catalog of known exploited vulnerabilities; both are risk signals, but the most important indicator here is that it is already being exploited.)