The vendor has published a fix. Version details are below where the sources state them.
Steps
Written by AI from the record
Check which Windows versions and update levels you run (Windows 10/11 and Windows Server 2019/2022/2025) on any machines your staff or contractors use.
Verify whether each machine is already at or beyond the fixed updates listed for its exact product/version.
Update Windows using Windows Update (or your patch management system) to the fixed versions for your platform.
If you cannot patch immediately, restrict who can get local user access (no untrusted accounts on the device) until updates are applied.
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
In plain language
Written by AI from the record
CVE-2026-49795 is a serious Windows bug that lets a low-privileged local user become fully admin or system-level; most small businesses should treat this as urgent if untrusted people can access a PC account locally.
CVE-2026-49795 is a local use-after-free privilege escalation in the Windows kernel that allows an authorized low-privileged local user to gain full administrative/system control, requiring no user interaction.
If you're affected
Full takeover of the affected PC
Stealthy admin-level control
Business disruption or downtime
Possible access to sensitive files
What is it
This is a Windows “coding mistake” in the core of the operating system. It can let a person who already has a limited local account on a machine “step up” to full admin/system control, like getting the keys to the building even if they started with a basic access badge.
Who is affected
This matters if you run or administer Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, or Windows Server 2025 on devices where an attacker could get local, low-privileged access. The risk is mainly for situations like shared/guest machines, poorly controlled contractor accounts, or any scenario where someone untrusted can sign in locally.
The vulnerability requires local access and low privileges, so it is typically a risk only if it is reachable through local logins/account access—not by just visiting a website.
How urgent is it
Mark this as high urgency for affected Windows systems because it’s a kernel-level flaw that can directly convert limited local access into full system control. Even if there’s no confirmed public exploit code, the impact is severe and attackers who can get local footholds commonly target this kind of escalation.
Because the verdict is RED, patching should be prioritized immediately for machines that might be exposed to untrusted local access.
What to do — in detail
Confirm whether you’re affected
Identify the OS and build of each relevant system:
Windows 10 (check the version/build family: 17763 vs 19044 vs 19045)
Windows 11 (check which branch/build you’re on)
Windows Server 2019/2022/2025 (match the server version)
Determine current installed update level for the OS (the Windows build/update number). This is what you compare against the fixed versions below.
Remediate to the fixed versions
Patch each system to a fixed build that matches your exact OS branch:
Windows 10 → fixed in 10.0.17763.9020
Windows 10 → fixed in 10.0.19044.7548
Windows 10 → fixed in 10.0.19045.7548
Windows 11 → fixed in 10.0.26100.8875
Windows 11 → fixed in 10.0.26200.8875
Windows 11 → fixed in 10.0.28000.2269
Windows Server 2019 → fixed in 10.0.17763.9020
Windows Server 2022 → fixed in 10.0.20348.5386
Windows Server 2025 → fixed in 10.0.26100.33158
The practical approach is to apply the Microsoft security update for CVE-2026-49795 for your OS branch via Windows Update or your patch management tool.
If you can’t patch right away (temporary containment)
Remove or limit local, low-privileged sign-in opportunities for untrusted people:
Disable or restrict any guest/contractor local accounts.
Avoid using shared accounts on workstations.
Ensure local user access is granted only to trusted staff.
Monitor for unusual local activity (sign-ins from unexpected accounts, new local users, or privilege changes), since the attack path starts with local access.
Deadlines
KEV: not listed in CISA KEV, so no CISA due date was provided in the findings.
Still, treat as urgent due to severity and the RED verdict.
What to monitor after patching
Successful installation of the security update.
No rollback/reversion to older build levels.
Continued signs of local compromise attempts (especially if systems were previously accessible by untrusted users).
Technical context
What’s the weakness
CVE-2026-49795 is a kernel use-after-free issue (CWE-416) in Windows. In plain terms, code can end up reusing memory after it should have been released, and that can be exploited to change the execution outcome.
Attack mechanism and prerequisites
Location: local only (AV:L)
Authentication: low privileges required (PR:L)
User interaction: none The findings state the attacker escalates from limited user privileges to full administrative or system-level control on a Windows system with local access.
Exploitation status
CISA KEV does not list this vulnerability. The findings do not provide a clear dated real-world exploitation claim, and there is no public exploit code on record. Despite that, the vulnerability is still rated RED due to its high-impact local privilege escalation nature.
Fix availability
Microsoft has fixed versions available for the affected OS branches, with explicit fixed build numbers provided in the patch findings. Apply the update corresponding to your exact Windows build family.
This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.
