Microsoft Patches Windows Elevation-of-Privilege Flaws in SMB Server and Projected File System

Microsoft published Security Update Guide advisories for multiple Windows elevation-of-privilege (EoP) vulnerabilities, including two affecting Windows SMB Server (CVE-2026-24294 and CVE-2026-26128) and one affecting Windows Projected File System (ProjFS) (CVE-2026-24290). The SMB Server issues are associated with CWE-287 (Improper Authentication), while the ProjFS issue is associated with CWE-284 (Improper Access Control); all are rated Important with Microsoft-provided CVSS v3.1 vectors indicating local exploitation conditions (e.g., AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Across the advisories, Microsoft’s scoring indicates an attacker would need existing local access and low privileges (PR:L) to exploit the flaws, with potential for high impact to confidentiality, integrity, and availability (C:H/I:H/A:H) if successfully leveraged for privilege escalation. One entry for CVE-2026-24294 appears twice (a duplicate URL variant), but it describes the same SMB Server EoP vulnerability and does not add distinct technical details beyond the core advisory metadata (severity, weakness class, and CVSS vector).