Loading story…
Microsoft disclosed and patched several Windows elevation-of-privilege vulnerabilities affecting core operating system components, including the UI Immersive Server API (CVE-2022-21864), Bind Filter Driver (CVE-2022-41114), Overlay Filter (CVE-2022-41101), Windows Kernel (CVE-2021-31979), and Group Policy (CVE-2022-37992). The flaws span both user-facing and low-level system components, indicating broad exposure across Windows environments if vulnerable systems remain unpatched.
The affected components are widely used in enterprise deployments, and successful exploitation could allow an attacker with existing access to gain higher privileges on a target system. The advisories place particular attention on privilege escalation risk inside Windows itself, where weaknesses in drivers, kernel functionality, and policy handling can be chained with other compromises to deepen attacker access and control.
Get the actors, campaigns, and ATT&CK mapping behind it.
4 events from the most recent confirmed update back to the earliest known activity.
Microsoft published Security Update Guide entries for CVE-2022-41114, CVE-2022-41101, and CVE-2022-37992, covering elevation of privilege flaws in the Windows Bind Filter Driver, Windows Overlay Filter, and Windows Group Policy.
Microsoft released Security Update Guide information for CVE-2022-21872, a Windows Event Tracing elevation of privilege vulnerability.
Microsoft released Security Update Guide information for CVE-2022-21864, a Windows UI Immersive Server API elevation of privilege vulnerability.
Microsoft released Security Update Guide information for CVE-2021-31979, a Windows Kernel elevation of privilege vulnerability.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
6 references tracked. Mallory keeps watching after this page renders.
msrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceportal.msrc.microsoft.com
Open sourceportal.msrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft published security advisories for a series of **Windows elevation-of-privilege** vulnerabilities affecting the **Windows Kernel**, **File Explorer**, **Windows Management Service**, **Windows UI XAML Phone DatePickerFlyout**, **Windows Graphics Component**, **Windows Storage**, and the **DirectX Graphics Kernel**. The referenced flaws include `CVE-2026-26132`, `CVE-2025-62565`, `CVE-2025-54103`, `CVE-2025-54111`, `CVE-2025-55693`, `CVE-2024-38249`, `CVE-2025-62573`, `CVE-2024-38248`, and `CVE-2025-55678`. The disclosures indicate a broad patching effort spanning core operating system subsystems and user-facing Windows components, with repeated exposure in privileged areas such as the kernel and graphics stack. For defenders, the concentration of elevation-of-privilege issues across these components raises the risk that attackers could chain local access or code execution with privilege escalation to gain **SYSTEM-level** or otherwise expanded rights on affected Windows systems, making prompt validation and deployment of Microsoft updates a priority.
Jun 29, 2026
Microsoft published security updates for several **Windows elevation of privilege** vulnerabilities affecting core components including **Win32k** (`CVE-2024-30082`, `CVE-2023-36743`), **Microsoft COM for Windows** (`CVE-2025-21281`), the **Microsoft Graphics Component** (`CVE-2025-49708`), and the **Windows Search Service** (`CVE-2026-27909`). The advisories indicate that successful exploitation could allow an attacker to gain higher privileges on a targeted Windows system, increasing the risk of broader compromise after initial access. The affected components span user interface, inter-process communication, graphics, and search functionality, showing continued exposure in widely deployed parts of the Windows platform. Microsoft issued entries for each CVE through its Security Update Guide, including both vulnerability and advisory records for `CVE-2025-21281`, and organizations should prioritize patching these flaws as part of routine Windows security maintenance because privilege escalation bugs are commonly chained with other exploits to obtain **SYSTEM**-level or administrative control.
Jul 12, 2026
Microsoft disclosed and patched multiple Windows elevation-of-privilege vulnerabilities affecting core system components, including the **Windows Kernel** (`CVE-2023-36403`) and the **Windows Graphics Component** (`CVE-2023-38159`, `CVE-2023-24899`). The flaws could allow an attacker who already has access to a target system to gain higher privileges, increasing the risk of full system compromise and broader post-exploitation activity. The advisories show a recurring pattern of privilege-escalation risk in foundational Windows components that are widely present across enterprise environments. Organizations running affected Windows systems should prioritize applying Microsoft security updates for the listed CVEs and review endpoint detections for signs of local privilege-escalation attempts tied to kernel- or graphics-related processes.
Jul 12, 2026