privilege-escalation-methodwidely-deployed-product-advisoryendpoint-software-vulnerabilityinternet-facing-service-vulnerability

Microsoft disclosed multiple Windows, IIS, and .NET elevation of privilege flaws

Attack Tradecraft · 6 sources · Updated 4mo ago · First seen May 25, 2026

Microsoft published security advisories for several elevation of privilege vulnerabilities affecting core enterprise technologies, including Win32k (CVE-2023-36732, CVE-2023-24902), Windows IIS Server (CVE-2023-36434), and .NET (CVE-2026-26131). The issues span both operating system and application server components, indicating potential paths for attackers to gain higher privileges after initial access on Windows-based environments.

The advisories were released through Microsoft's Security Update Guide and portal, signaling that organizations running affected Windows desktops, servers, web infrastructure, or .NET workloads should review product exposure and apply the relevant security updates. For defenders, the concentration of privilege-escalation bugs across Win32k, IIS, and .NET underscores the need to prioritize patching on systems where local access, web server compromise, or application-layer abuse could be leveraged to obtain elevated permissions.

Who uses this technique?Get the actors, campaigns, and ATT&CK mapping behind it.

Get the tradecraft

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

5 events · May 9, 2023 – Mar 10, 2026

Mar 10, 20268mo ago
Microsoft publishes advisory for CVE-2026-26131
Microsoft published a Security Update Guide entry for CVE-2026-26131, a .NET Elevation of Privilege vulnerability.
Oct 10, 20233y ago
Microsoft publishes advisory for CVE-2023-36731
Microsoft published a Security Update Guide entry for CVE-2023-36731, a Win32k Elevation of Privilege vulnerability.
CVE-2023-36731 - Security Update Guide - Microsoft - Win32k Elevation of Privilege Vulnerability
Oct 10, 20233y ago
Microsoft publishes advisory for CVE-2023-36434
Microsoft published a Security Update Guide entry for CVE-2023-36434, a Windows IIS Server Elevation of Privilege vulnerability.
Oct 10, 20233y ago
Microsoft publishes advisory for CVE-2023-36732
Microsoft published a Security Update Guide entry for CVE-2023-36732, a Win32k Elevation of Privilege vulnerability.
May 9, 20233y ago
Microsoft publishes advisory for CVE-2023-24902
Microsoft published a Security Update Guide entry for CVE-2023-24902, a Win32k Elevation of Privilege vulnerability.

Do you run this?Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.

See Who Uses This Technique

Source coverage

Sources

6 references tracked. Mallory keeps watching after this page renders.

Msrc MicrosoftAdvisories · Mar 10, 2026

CVE-2026-26131 - Security Update Guide - Microsoft - .NET Elevation of Privilege VulnerabilityOpen source ↗

Msrc Product AdvisoriesAdvisories · Oct 10, 2023

CVE-2023-36732 - Security Update Guide - Microsoft - Win32k Elevation of Privilege VulnerabilityOpen source ↗

Msrc Product AdvisoriesAdvisories · Oct 10, 2023

CVE-2023-36434 - Security Update Guide - Microsoft - Windows IIS Server Elevation of Privilege VulnerabilityOpen source ↗

Msrc Product AdvisoriesAdvisories · Oct 10, 2023

CVE-2023-36731 - Security Update Guide - Microsoft - Win32k Elevation of Privilege VulnerabilityOpen source ↗

Msrc MicrosoftAdvisories · Oct 10, 2023

CVE-2023-36434 - Security Update Guide - Microsoft - Windows IIS Server Elevation of Privilege VulnerabilityOpen source ↗

Msrc PortalAdvisories · May 9, 2023

CVE-2023-24902 - Security Update Guide - Microsoft - Win32k Elevation of Privilege VulnerabilityOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Microsoft disclosed multiple Windows, IIS, and .NET elevation of privilege flaws

How this story unfolded

Microsoft publishes advisory for CVE-2026-26131

Microsoft publishes advisory for CVE-2023-36731

Microsoft publishes advisory for CVE-2023-36434

Microsoft publishes advisory for CVE-2023-36732

Microsoft publishes advisory for CVE-2023-24902

Sources

See the full picture, correlated to your attack surface.

Related stories

Microsoft discloses multiple elevation-of-privilege flaws across Windows and developer tools

Microsoft Win32k Elevation of Privilege Vulnerabilities Disclosed

Microsoft Patches Multiple Windows Elevation of Privilege Flaws

Microsoft disclosed multiple Windows, IIS, and .NET elevation of privilege flaws

How this story unfolded

Microsoft publishes advisory for CVE-2026-26131

Microsoft publishes advisory for CVE-2023-36731

Microsoft publishes advisory for CVE-2023-36434

Microsoft publishes advisory for CVE-2023-36732

Microsoft publishes advisory for CVE-2023-24902

Sources

See the full picture, correlated to your attack surface.

Related stories

Microsoft discloses multiple elevation-of-privilege flaws across Windows and developer tools

Microsoft Win32k Elevation of Privilege Vulnerabilities Disclosed

Microsoft Patches Multiple Windows Elevation of Privilege Flaws