The vendor has published a fix. Version details are below where the sources state them.
Steps
Written by AI from the record
Check whether your organization uses any of these: Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, or Windows Server 2025.
For each affected device, identify the installed OS build/patch level (Windows Update “View update history” and/or system version).
Update Windows until it reaches the fixed version for your edition:
Windows 10: 10.0.17763.9020 (or 10.0.19044.7548, or 10.0.19045.7548)
Windows 11: 10.0.26100.8875 (or 10.0.26200.8875, or 10.0.28000.2269)
Windows Server 2019: 10.0.17763.9020
Windows Server 2022: 10.0.20348.5386
Windows Server 2025: 10.0.26100.33158
If you can’t patch immediately, restrict local logins on the machine to only necessary accounts (since exploitation requires low-level privileges locally), and treat any unapproved local accounts as a high priority to remove.
Insufficient granularity of access control in Windows StateRepository API allows an authorized attacker to elevate privileges locally.
In plain language
Written by AI from the record
This is a Windows local privilege-escalation flaw that could let a low-privilege user gain administrator/system power; if your business machines are running these Windows versions and aren’t fully updated, you should act.
CVE-2026-49170 is a local Windows StateRepository API Server weakness (CWE-285/CWE-1220) where insufficient access-control granularity lets a low-privileged, locally authenticated user elevate to administrator/system.
If you're affected
Full administrator takeover
Malware run with system power
Business disruption from compromise
Data access via admin privileges
What is it
Think of Windows as having “doors” for different services. This vulnerability is in a Windows service related to the StateRepository API, where the door doesn’t properly check whether the person using it should be allowed to do powerful actions.
If someone already has a basic (low-privilege) local account, they may be able to use this mistake to gain much higher privileges—like becoming an administrator or system-level user.
Who is affected
This matters if your business runs Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, or Windows Server 2025 on computers where users can log in with low-level privileges.
Because the flaw is local, it’s primarily a risk if an attacker can already get a foothold on the machine with limited access (local access is required), rather than from just reaching the device over the network.
How urgent is it
This is a RED-priority issue because it allows a local attacker with limited privileges to elevate to administrator/system power.
Even without clear public reports of active exploitation, privilege-escalation weaknesses are high impact and are typically addressed through immediate patching because they can turn a minor compromise into full control.
What to do — in detail
Confirm exposure
Identify which systems are running one of the affected products: Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, Windows Server 2025.
On each system, determine the current OS version/build number.
Typical approach: Settings → Windows Update → View update history (look for cumulative update status), and cross-check with the “OS build” shown in system information.
Check whether you’re already fixed
Patch state is based on reaching the fixed versions listed below.
Windows 10 is fixed in one of: 10.0.17763.9020, 10.0.19044.7548, 10.0.19045.7548
Windows 11 is fixed in one of: 10.0.26100.8875, 10.0.26200.8875, 10.0.28000.2269
Windows Server 2019 is fixed in: 10.0.17763.9020
Windows Server 2022 is fixed in: 10.0.20348.5386
Windows Server 2025 is fixed in: 10.0.26100.33158
If your OS build is below the applicable fixed version, treat the host as likely vulnerable.
Upgrade / remediation path
Apply the latest available Windows updates for each machine until the build number matches a listed fixed version.
Reboot after patch installation if your environment requires it to complete update application.
Validate that Windows Update shows the system as updated (and that the OS build remains at/above the target fixed version).
Temporary workaround (if patching is delayed)
Because exploitation requires local low-level privileges, reduce the likelihood of an attacker having that foothold:
Limit which users can sign in locally.
Remove or disable unnecessary local accounts and service accounts.
Review for suspicious or unknown local users.
What to monitor
Monitor for signs of unauthorized local account use and changes (new local users, unexpected logins, privilege changes).
Ensure endpoint logging/alerts are enabled so local suspicious activity can be investigated quickly.
KEV / exploit status handling
This CVE is not listed in CISA KEV (based on the findings provided).
No dated public reporting of in-the-wild exploitation was identified in the provided findings.
Even so, patch because the impact is full privilege elevation and the weakness is reachable by a local attacker with low-level credentials.
Technical context
CVE-2026-49170 is a Windows local privilege-escalation vulnerability affecting the Windows StateRepository API Server. The weakness is attributed to insufficient granularity of access control (CWE-285) and improper authorization behavior (CWE-1220), where a locally authenticated user with limited privileges can perform actions that should be restricted to higher-privilege contexts.
Attack model from findings: local attack vector; low authentication/authorization requirement; no user interaction required; precondition is that the attacker already has low-level privileges on the system.
Exploitation/exploit availability: no public exploit code is noted in the provided findings, and no clear dated press claim of exploitation was identified. KEV status is not present in the provided findings.
Operational takeaway: prioritize patching to the fixed build numbers listed, since success would enable administrator/system-level actions after an attacker already has local access.
This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.
