CVE-2026-49805

Imagine your computer has a “front door” for regular users, and this bug acts like a hidden shortcut to climb past that front door into higher-power areas of the system. If someone already has some access on the same computer, they may be able to take control and do much more than a normal user could.

This matters if you use or manage any of the affected Windows versions: Windows 10, Windows 11, and the listed Windows Server editions. It’s a local issue: an attacker needs low privileges and access on the same machine, and no user action is required once they are on the system. This is mainly a risk when a malicious person can already get local access (for example, a compromised account or physical/local access), because default reachability from the internet is not known.

This is RED because it is a local privilege-escalation flaw that can turn a low-privileged foothold into full administrator or kernel-level control on the same machine. Even though no clear, dated public exploitation claims were found in the provided materials, the impact of a successful local escalation is severe, and patches are available for multiple supported branches.

Confirm whether you’re exposed

1. On each affected host, identify:
   • The Windows edition (Windows 10 vs Windows 11 vs Windows Server and which year)
   • The OS build number.
2. Compare your build number against the fixed versions below for your specific edition:
   • Windows 10: fixed in 10.0.14393.9339, 10.0.17763.9020, 10.0.19044.7548, 10.0.19045.7548
   • Windows 11: fixed in 10.0.26100.8875, 10.0.26200.8875, 10.0.28000.2269
   • Windows Server 2012: fixed in 6.2.9200.26226
   • Windows Server 2012 R2: fixed in 6.3.9600.23291
   • Windows Server 2016: fixed in 10.0.14393.9339
   • Windows Server 2019: fixed in 10.0.17763.9020
   • Windows Server 2022: fixed in 10.0.20348.5386

Remediate (patch/upgrade)

1. Apply the Windows security updates that bring the host to (or above) the fixed build for your edition.
2. Prioritize:
   • Machines where local logons are common (shared workstations, admin-heavy systems)
   • Systems with recent suspicious activity
   • Servers with broad user access.

If you can’t patch immediately (workarounds)

• Reduce the chance an attacker can start with “low-level access”:
  • Remove unnecessary local user accounts and disable accounts that don’t need local logon.
  • Limit who can physically access the machine and who can create or use local accounts.
  • Review any recent account compromises and reset credentials as needed.

What to watch after patching

• Confirm the OS build changed to a patched level.
• Look for unusual local privilege changes and suspicious admin activity after the patch window (your existing Windows logging/alerting should already cover this; adjust rules only if you see repeated patterns).

KEV / exploitation status

• This CVE is not listed in CISA KEV, and the provided materials did not include clear, dated claims of exploitation or a public exploit code.

CVE-2026-49805 is a Windows Win32K local privilege escalation (CWE-284) caused by improper access control. A low-privileged, authorized attacker on the same machine can exploit the flaw without user interaction to escalate their privileges to administrator or potentially kernel-level impact. The provided findings indicate local access and low-privilege starting conditions, with “reachable in default config” not confirmed. No KEV listing and no public exploit code were identified in the provided materials, and press articles did not provide clear dated exploitation claims. Patch guidance is available via fixed OS build numbers across multiple Windows 10/11 and Windows Server branches.