CVE-2026-66799

Think of Windows Key Guard as a security “lock” inside Windows. This bug is like a mistake in how that lock handles certain memory data, which could let someone who already has some permission on the machine punch through and gain much higher control. Because it targets privilege levels, an attacker could then do more harmful actions on your PC or server.

This matters if you run one of these Microsoft products: Windows 10, Windows 11, and the listed Windows Server versions. It’s not about a remote attacker guessing a password—this issue is described as requiring an authorized attacker locally, meaning it’s mainly a risk when someone already has some access on the device (for example, a compromised account or insider access). Patch risk is therefore highest when the vulnerable component is reachable on the machine and there is already local access by an attacker.

This is a RED issue because Microsoft has a patch available and it is tied to a newly reported security problem (press attention indicates active interest by a known threat actor). Even though there’s no public exploit code on record and it’s not in the CISA KEV list, the impact is privilege elevation, so you should treat it as an urgent patching target for affected machines.

Confirm exposure

1. For each device, record:
   • Windows version (Windows 10 / Windows 11 / which Windows Server generation)
   • Current build number (what you see under Windows version details, e.g., “10.0.x…” or “6.2…” / “6.3…”)
2. Check whether Windows Key Guard is in use on that machine (if your organization uses it as part of its Windows security configuration, consider it in scope).

Compare against Microsoft’s fixed builds

Apply the patch so the system build is at or above the fixed versions for your specific release:

• Windows 10 fixed in:
  • 10.0.14393.9418
  • 10.0.17763.9121
  • 10.0.19044.7663
  • 10.0.19045.7663
• Windows 11 fixed in:
  • 10.0.22631.7517
  • 10.0.26100.9168
  • 10.0.26200.9168
  • 10.0.28000.2704
• Windows Server 2012 fixed in:
  • 6.2.9200.26280
• Windows Server 2012 R2 fixed in:
  • 6.3.9600.23338
• Windows Server 2016 fixed in:
  • 10.0.14393.9418
• Windows Server 2019 fixed in:
  • 10.0.17763.9121

Upgrade / patch steps

1. Use Microsoft Update / Windows Update (or your enterprise patch management) to install the updates referenced by Microsoft’s CVE update guide for CVE-2026-66799.
2. Reboot if prompted (and schedule it to minimize downtime).
3. Verify after reboot that the build number matches a fixed value listed above.

Workarounds (if patching is delayed)

No specific mitigation workaround is provided in the available findings. The practical workaround is to reduce the chance of local unauthorized access while patching is pending (e.g., restrict who can log onto the affected machines and tighten local admin access), since the described risk centers on a local authorized attacker.

Monitoring after patching

• Confirm Windows Update reports success for CVE-2026-66799.
• Review access logs for suspicious local logins or privilege changes on devices while you complete rollout.

Due date

No CISA KEV due date was provided in the findings.

CVE-2026-66799 is a Windows Key Guard heap-based buffer overflow (CWE-122). The reported mechanism is local privilege elevation: an authorized attacker with local access can trigger the flaw to gain higher privileges. The findings note that it is not listed in CISA KEV, there is no public exploit code on record, and there is no KEV-confirmed exploitation signal in the provided data. However, press attention indicates patch-related activity involving a named threat actor (Lazarus group), and Microsoft has fixed builds for multiple Windows 10/11 and Windows Server branches. The patch availability is the primary actionable detail: upgrade each system to the fixed build numbers listed in Microsoft’s update guide for CVE-2026-66799.