CVE-2026-61925

Windows Installer Elevation of Privilege Vulnerability

No known exploitation. EPSS puts it in the 20th percentile. A vendor fix is available.

CVSS 3.17.8High EPSS percentile20th0.3% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-08-11Updated 2026-08-17Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check which affected Windows version/build number your business devices and servers are running (including Windows Installer usage via normal installs/updates).
If the device is on one of the affected versions, plan an immediate update to the fixed build for that exact Windows version branch.
Apply the Microsoft update for CVE-2026-61925 using the Microsoft Update Guide instructions.
After patching, verify the OS build number matches one of the fixed versions listed in this note and re-run your routine update checks to confirm no pending updates remain.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Incorrect authorization in Windows Installer allows an authorized attacker to elevate privileges locally.

In plain language

Written by AI from the record

CVE-2026-61925 is a Windows Installer flaw that can let someone who already has low-level access gain full administrative control; if your business PCs or servers are using an affected Windows version, you should patch—this is serious even though it’s not an “internet worm” type issue.

CVE-2026-61925 is a local elevation of privilege in Windows Installer (CWE-863, incorrect authorization): an attacker who already has low-privilege access can trigger a permissions/validation logic error to execute code with higher administrative rights, enabling full system impact without user interaction.

If you're affected

Full admin control of machines
Read sensitive data on servers
Alter or destroy business files
Service disruption or outages

What is it

Windows Installer is the part of Windows that handles installing and updating software. This bug is like a “bouncer” that mis-checks who is allowed to do what—so a person who already has limited access can trick the installer into performing actions at full administrator level. That can mean they read secret data, change files, or disrupt services.

Who is affected

This matters to you if you run or manage any of these Windows versions: Windows 10, Windows 11, and Windows Server 2012/2012 R2/2016/2019/2022/2025. The attack requires an attacker to already have low-privilege access on the machine (it’s not a simple “click a link to get in” internet attack), and it is triggered through Windows Installer behavior with no extra user interaction.

How urgent is it

This is urgent because the flaw enables an attacker to move from low privileges to full administrative control on the same machine. Even though it’s a local privilege escalation (not internet-only), attackers associated with serious campaigns have shown interest in this class of weaknesses, and a patch exists for all affected branches.

What to do — in detail

Confirm exposure (per device/server)
- Identify the OS version and build number on each Windows 10/11 and Windows Server system.
- CVE-2026-61925 applies to the listed products, and patching is done by moving to the fixed build for your specific branch (below).
Determine the correct fixed version for your branch
- Windows 10:
  - fixed in 10.0.14393.9418
  - fixed in 10.0.17763.9121
  - fixed in 10.0.19044.7663
  - fixed in 10.0.19045.7663
- Windows 11:
  - fixed in 10.0.22631.7517
  - fixed in 10.0.26100.9168
  - fixed in 10.0.26200.9168
  - fixed in 10.0.28000.2704
- Windows Server 2012:
  - fixed in 6.2.9200.26280
- Windows Server 2012 R2:
  - fixed in 6.3.9600.23338
- Windows Server 2016:
  - fixed in 10.0.14393.9418
- Windows Server 2019:
  - fixed in 10.0.17763.9121
- (Windows Server 2022/2025 are included in the affected product list provided, but this finding set only lists fixed builds for the above specific branches; use the Microsoft Update Guide to select the correct update for your exact build.)
Apply the fix
- Use Microsoft’s update guidance for CVE-2026-61925 and apply the corresponding cumulative update/patch to reach the fixed build.
- Roll out via your normal maintenance window while prioritizing systems with:
  - remote administration,
  - frequent software installation/updates,
  - users who could already have low-privilege access.
Verification
- Re-check each machine’s build number after reboot/update completion.
- Confirm no relevant updates remain pending.
If you cannot patch immediately (temporary containment)
- Because this is a local privilege escalation requiring low-privilege access, reduce the chance that an attacker can get that foothold:
  - limit who can run software/installers,
  - restrict local admin where possible,
  - review endpoint access controls and privilege model.
- Keep focusing on patching first; workarounds are not a substitute for fixing authorization logic.
What to monitor
- Watch for suspicious local behavior around software installation/Windows Installer activity on endpoints where an attacker may already be present (e.g., unexpected process starts or file changes following installation activity).

Technical context

CVE-2026-61925 is a Windows Installer local elevation of privilege (CWE-863: incorrect authorization). Mechanism: an attacker with low-privilege access can exploit a permissions/verification logic error in Windows Installer to execute code with higher administrative rights, without user interaction. Impact includes reading secrets, modifying files, and disrupting services.

Findings indicate no KEV listing and no public exploit code on record, and exploitation details for this specific CVE are not clearly dated in the provided news findings; however, the press findings mention a related broader campaign context (actor: Lazarus group) and that another CVE (CVE-2026-68820) is reported as exploited in the wild. Overall risk is treated as RED due to confirmed fix availability across major branches and the high impact of privilege escalation on systems where an attacker can already obtain low-level access.

EPSS was provided as a prediction only (0.3%, flat trend), and should not be treated as a guarantee of real-world exploitability.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS20th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.3% chance of exploitation activity in the next 30 days, which ranks it in the 20th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

11 events over 6 days, from the signal feeds we watch.

2026-08-17Patch availablerecord updated
2026-08-16Record updated
2026-08-13OpenVAS check added
2026-08-12Record updatedrecord updated
2026-08-11Publishedweakness classified, att&ck mapped, record updated, record updated

Affected products

Microsoftcommercial · US

And 25 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Scored 7.8 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable