privilege-escalation-techniqueendpoint-software-vulnerabilitywidely-deployed-product-advisory

Windows Kernel Elevation of Privilege Vulnerability (CVE-2026-26132)

Attack Tradecraft · 3 sources · Updated 4mo ago · First seen Mar 11, 2026

Microsoft published details for CVE-2026-26132, an Important severity Windows Kernel elevation of privilege vulnerability caused by CWE-416 (use-after-free). The issue is scored CVSS 3.1: 7.8 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating exploitation requires local access and low complexity, with low privileges required and no user interaction, and could result in high impact to confidentiality, integrity, and availability.

Microsoft’s Security Update Guide entry provides standard machine-consumable references (e.g., PowerShell, API, and CSAF links) for tracking and patch management. No additional exploitation details, in-the-wild exploitation confirmation, or public proof-of-concept information is included in the provided material beyond the vulnerability classification and scoring.

Who uses this technique?Get the actors, campaigns, and ATT&CK mapping behind it.

Get the tradecraft

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

2 events · Mar 10, 2026

Mar 10, 20268mo ago
Microsoft publishes advisory for CVE-2026-26132 Windows Kernel EoP flaw
Microsoft published CVE-2026-26132 in its Security Update Guide as a Windows Kernel Elevation of Privilege vulnerability. Two references point to the same Microsoft advisory and represent a single disclosure event.
Mar 10, 20268mo ago
Microsoft publishes advisory for CVE-2026-25187 Winlogon EoP flaw
Microsoft added CVE-2026-25187 to its Security Update Guide as a Winlogon Elevation of Privilege vulnerability. The reference indicates public disclosure on Microsoft's March 10, 2026 update cycle.

Do you run this?Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.

See Who Uses This Technique

Source coverage

Sources

3 references tracked. Mallory keeps watching after this page renders.

Msrc Security AdvisoriesAdvisories · Mar 10, 2026

CVE-2026-26132 - Security Update Guide - Microsoft - Windows Kernel Elevation of Privilege VulnerabilityOpen source ↗

Msrc MicrosoftAdvisories · Mar 10, 2026

CVE-2026-26132 - Security Update Guide - Microsoft - Windows Kernel Elevation of Privilege VulnerabilityOpen source ↗

Msrc MicrosoftAdvisories · Mar 10, 2026

CVE-2026-25187 - Security Update Guide - Microsoft - Winlogon Elevation of Privilege VulnerabilityOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Windows Kernel Elevation of Privilege Vulnerability (CVE-2026-26132)

How this story unfolded

Microsoft publishes advisory for CVE-2026-26132 Windows Kernel EoP flaw

Microsoft publishes advisory for CVE-2026-25187 Winlogon EoP flaw

Sources

See the full picture, correlated to your attack surface.

Related stories

Microsoft Windows Kernel Elevation of Privilege Vulnerability (CVE-2026-24289)

Active Exploitation of Windows Kernel Privilege Escalation Vulnerability CVE-2025-62215

Microsoft Win32k Elevation of Privilege Vulnerabilities Disclosed

Windows Kernel Elevation of Privilege Vulnerability (CVE-2026-26132)

How this story unfolded

Microsoft publishes advisory for CVE-2026-26132 Windows Kernel EoP flaw

Microsoft publishes advisory for CVE-2026-25187 Winlogon EoP flaw

Sources

See the full picture, correlated to your attack surface.

Related stories

Microsoft Windows Kernel Elevation of Privilege Vulnerability (CVE-2026-24289)

Active Exploitation of Windows Kernel Privilege Escalation Vulnerability CVE-2025-62215

Microsoft Win32k Elevation of Privilege Vulnerabilities Disclosed