CVE-2026-61930

Think of the Windows “kernel” as the core engine that runs the whole computer. This vulnerability is like a mistake in that engine that, once someone already has a foothold on the machine, can be abused to break out and gain the highest level of control (admin/system).

This matters if your business uses Windows 10, Windows 11, or Windows Server 2016/2019/2022/2025. The risk is mainly to devices where an attacker can already get an authorized local foothold (for example, a compromised account or other local access). It’s not a “remote drive-by” issue in the findings; the attacker must be able to reach the local system context to trigger the privilege escalation.

This is RED because it’s a Windows Kernel elevation-of-privilege vulnerability with a clear path to full control once an attacker has local access, and new threat-actor-related activity has been reported (Lazarus group). Even though there is no public exploit code on record and it’s not in CISA KEV, you should treat it as an urgent patching priority on affected systems.

1. Identify affected systems:

   • Inventory your endpoints and servers running Windows 10/11 and Windows Server 2016/2019/2022/2025.
   • For each machine, record the current OS build number.

2. Confirm you’re on a fixed version (target versions):

   • Windows 10: 10.0.14393.9418 OR 10.0.17763.9121 OR 10.0.19044.7663 OR 10.0.19045.7663
   • Windows 11: 10.0.22631.7517 OR 10.0.26100.9168 OR 10.0.26200.9168 OR 10.0.28000.2704
   • Windows Server 2016: 10.0.14393.9418
   • Windows Server 2019: 10.0.17763.9121
   • Windows Server 2022: 10.0.20348.5499
   • Windows Server 2025: 10.0.26100.33296

3. Upgrade/patch:

   • Apply Microsoft’s security update for CVE-2026-61930 via your normal patch process (Windows Update, WSUS, or your endpoint management tool).
   • After patching, re-check the build number to ensure it matches one of the fixed versions above.

4. If patching is delayed (temporary risk reduction):

   • Reduce the number of users who can log on locally to these machines.
   • Review and tighten controls around any accounts that could provide “authorized” local access (for example, local admin access, remote admin tooling used by staff, and any service accounts).
   • Watch for signs of compromise, since this is the kind of bug attackers use after they already have some access.

5. CISA KEV note and monitoring:

   • This CVE is not currently listed in CISA KEV.
   • Monitor endpoint/server logs and alerts for unusual local privilege changes or suspicious activity around the time you patch (to ensure you didn’t already get compromised).

CVE-2026-61930 is rated HIGH (CVSS 7.8) and involves a heap-based buffer overflow in the Windows Kernel, categorized as CWE-122. The mechanism is a memory corruption that can be triggered in a way that allows a local attacker with authorized access to elevate privileges, resulting in full control of the affected system.

From the findings: no public exploit code is on record, and the vulnerability is not listed in CISA KEV. However, reported actor-related interest has been noted (Lazarus group in the PULSE findings), and the operational risk is therefore treated as immediate for affected Windows builds. The EPSS provided in the findings is a prediction and is not relied on for action prioritization here due to the RED verdict and threat-activity signal.