CVE-2026-61358

ATBroker.exe is part of Windows accessibility features (the “accessibility infrastructure” used to support assistive tools). This vulnerability is a mistake in how Windows resolves file references, which can let a logged-in attacker use Windows itself to gain higher privileges.

Think of it like a locked door that accidentally follows the wrong address—if someone is already on your property, they may be able to use that mistake to get into restricted areas.

This matters if your business uses Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, or Windows Server 2025, especially on machines where an attacker may be able to run code as a legitimate user (for example after phishing or stolen credentials).

Because the weakness requires an “authorized attacker” locally, you should treat it as a serious patching priority if an attacker could already have a foothold on any affected endpoint or server, not as a purely remote risk.

This is RED because the weakness can be used to gain higher privileges locally, and there is press attention tied to patching activity. Even without public exploit code on record or KEV listing, the attacker model here is “someone already has a foothold,” which is a common real-world starting point.

Patch as soon as possible for all affected Windows versions, prioritizing systems that are more exposed to user-level compromise (remote users, email-heavy systems, and servers with interactive logins).

1. Confirm exposure (per machine)

   • For each Windows 10/11 and Windows Server 2019/2022/2025 device, record the Windows build number.
   • Use winver or Settings → System → About to capture the build.

2. Determine whether you’re on a vulnerable build

   • Apply the fixed-build mapping from Microsoft for CVE-2026-61358:
     • Windows 10: fixed in 10.0.17763.9121, 10.0.19044.7663, 10.0.19045.7663 (also listed: 10.0.17763.9115)
     • Windows 11: fixed in 10.0.22631.7517, 10.0.26100.9168, 10.0.26200.9168, 10.0.28000.2704 (also listed: 10.0.26100.9106)
     • Windows Server 2019: fixed in 10.0.17763.9121
     • Windows Server 2022: fixed in 10.0.20348.5499
     • Windows Server 2025: fixed in 10.0.26100.33296
   • Any system with a build lower than the fixed version(s) for its release should be treated as needing update.

3. Patch

   • Install the Microsoft security update for CVE-2026-61358 via Windows Update or your standard patch mechanism, using the MSRC update guide as the source of truth.
   • Ensure the patch applies cleanly and reboots are completed.

4. Validate

   • Re-check the build number after reboot.
   • Confirm no update errors are present in the Windows Update history.

5. If patching is delayed (workarounds)

   • Reduce the chance of a local “authorized attacker” scenario by tightening account security:
     • Require strong passwords/MFA where applicable.
     • Review and restrict who can log on interactively to servers and privileged systems.
     • Monitor for signs of credential compromise and suspicious local activity (because this vulnerability’s risk is tied to local, authorized access).

6. What to monitor after patching

   • Windows security/event logs for privilege changes or unusual processes tied to accessibility components.
   • Any incident indicators that suggest a user-level compromise occurred before patching.

Severity is HIGH (CVSS 7.8) and the weakness is CWE-59 (improper link resolution before file access, commonly described as link following). The affected component is Windows Accessibility Infrastructure (ATBroker.exe). The mechanism is that a local, authorized attacker can take advantage of how Windows resolves links/files prior to access to elevate privileges.

Findings summary: Microsoft has published fixed builds for multiple Windows 10/11 and Windows Server branches. There is no listing in CISA KEV and no public exploit code on record. Press attention indicates actor interest related to patching activity (Lazarus group), but exploit code/maturity details are not confirmed in the provided findings.

What KEV “not listed” means here: there is no CISA KEV indicator in the provided material that this is being exploited widely/known-by-CISA, but the impact is still serious because the attacker requirement is “local authorized access,” which can be achieved after credential theft or other common initial compromises.