CVE-2026-61929

Think of your computer’s kernel as the core engine that everything depends on. This bug happens when the system uses a piece of memory after it’s already been cleaned up, which can be abused by someone who already has a foothold on the machine to break out of normal permissions and take control.

This matters if your business runs Windows 11 or Windows Server 2025. Because this is a local privilege escalation with an authorized attacker requirement, it’s mainly a risk if an attacker can already get onto a device (for example via stolen credentials, malware, or another local foothold). Patch impact is therefore highest on machines that are reachable and regularly used by people, and where attackers could realistically obtain a local foothold.

This is RED because it’s a Windows kernel privilege escalation vulnerability that can turn an attacker’s local access into full control of the machine. Even though there’s no public exploit code recorded and it’s not listed in CISA KEV, Microsoft has already shipped fixes for multiple Windows branches, so you should prioritize patching immediately for impacted systems.

1. Identify affected systems

   • On each workstation/server, note whether it is Windows 11 or Windows Server 2025.
   • Record the exact OS version/build number (so you can match against the fixed versions below).

2. Determine whether you are exposed

   • A device is exposed if it’s running one of the affected products (Windows 11 or Windows Server 2025) and you have not updated to a fixed build listed by Microsoft for CVE-2026-61929.

3. Patch to the correct fixed build

   • Windows 11 fixed versions include:
     • 10.0.22631.7517
     • 10.0.26100.9106
     • 10.0.26200.9106
     • 10.0.28000.2704
     • 10.0.26100.9168
     • 10.0.26200.9168
   • Windows Server 2025 fixed versions include:
     • 10.0.26100.33222
     • 10.0.26100.33296
   • Use Microsoft’s Update Guide for CVE-2026-61929 to ensure you’re installing the correct updates for your specific branch.

4. Validation after updating

   • Re-check the OS build number after reboot to confirm it matches one of the fixed versions above.

5. If patching is delayed (temporary containment)

   • Reduce the chance of a local foothold: enforce strong access controls, ensure endpoint protection is active, and limit who can log on locally.
   • Prioritize machines exposed to higher-risk activity (email browsing, web-facing workflows, admin workstations).
   • Monitor for suspicious signs of already-existing compromise (unexpected admin changes, unusual process behavior, or other endpoint security alerts).

6. Ongoing monitoring

   • After you patch, keep an eye on endpoint detections and vulnerability/update status so you don’t miss any devices that were offline during rollout.

CISA KEV note: CVE-2026-61929 is not listed in the CISA KEV set based on the provided findings.

Severity/impact: This is a Windows Kernel elevation of privilege vulnerability (CWE-416) where a use-after-free condition can be exploited by an authenticated/local attacker to gain higher privileges on the affected OS.

Attack vector and prerequisite: The technical description indicates an authorized attacker scenario; practically, this means the attacker needs a local foothold (for example, valid access to run code on the machine) rather than being purely remote.

Exploitation status: No public exploit code was found in the provided findings, and the CVE is not present in CISA KEV. The traffic-light verdict for this CVE is RED.

Patch availability: Microsoft has fixed builds across multiple Windows branches for Windows 11 and Windows Server 2025, listed in the Patch findings.

Press/actor signal: The provided PULSE finding notes new press attention and an actor association (Lazarus group) alongside the patch announcement; this is not proof of exploitation for all users, but it supports taking patching seriously.

EPSS: Only a prediction was provided (trend flat). Per the guidance, this prediction should not be treated as exploitation evidence.