Loading story…
Microsoft fixed CVE-2026-50343, a Windows 11 local privilege escalation flaw dubbed Dark Elevator that lets a standard user obtain an interactive NT AUTHORITY\SYSTEM shell by coercing InstallService into loading an attacker-controlled DLL inside a SYSTEM svchost.exe process. The issue affects the Windows app installation pipeline and was demonstrated on Windows 11 build 10.0.26200.8457, including Windows 11 25H2, with researchers describing exploitation as deterministic and requiring no administrator rights, UAC approval, reboot, or service-control permissions.
The exploit chains two logic flaws: a user-writable StaticPluginMap registry location that InstallService uses to select COM plugins, and a Windows-shipped CrossDevice COM class whose InprocServer32 DLL path points to a writable location under %PROGRAMDATA%. By abusing COM object loading behavior associated with functions such as CoCreateInstance, an attacker can force privileged code to load a malicious library and execute within a Microsoft-signed SYSTEM service process, enabling persistence, privileged account creation, service installation, tampering with machine-wide settings, access to other users' data, and interference with local security controls.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
A local privilege escalation flaw in the Windows Install Service, dubbed "Dark Elevator," was fixed by Microsoft and assigned CVE-2026-50343. The vulnerability allows a normal user to coerce InstallService into loading an attacker-controlled DLL into a SYSTEM svchost.exe process.
A public write-up disclosed exploit details showing how two logic flaws can be chained: a user-writable StaticPluginMap registry location and a writable DLL path for a Windows-shipped CrossDevice COM class. The report said exploitation was deterministic on tested Windows 11 systems and could yield an interactive NT AUTHORITY\SYSTEM shell without admin rights, UAC approval, reboot, or service-control permissions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourceblog.calif.io
Open sourcelearn.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google Project Zero disclosed **CVE-2026-66804**, a Windows local privilege-escalation flaw caused by a dangling system-wide COM registration for the `CrossDevice` class. The registration referenced a missing DLL in a user-writable `ProgramData` location, allowing a local attacker to place a malicious DLL where it could be loaded by a privileged process. Exploitation uses custom COM marshaling to make a SYSTEM-level Shell Create Object Handler COM server unmarshal the dangling CLSID and load the attacker-controlled DLL, potentially granting SYSTEM-level execution. The vulnerability was an incomplete remediation of **CVE-2026-50343** (Dark Elevator); Microsoft has issued a fix, and Project Zero reported that a working exploit was supplied with the original report.
Sep 22, 2026
Security researchers disclosed **"Plug And Pwn,"** a technique that abuses Windows 11 Plug and Play auto-install behavior to gain `NT AUTHORITY\SYSTEM` code execution on fully updated systems without a kernel zero-day. By presenting a crafted or emulated USB device, the attack causes Windows to fetch signed vendor driver packages and run privileged installation components before user logon. The demonstrated chains relied on weaknesses in third-party software tied to devices from **Sierra Wireless, Sony FeliCa, Intel RealSense, Wacom, and Atheros**, including DNS manipulation, plaintext HTTP configuration retrieval, path traversal, arbitrary file write, privileged registry abuse, and DLL search-order hijacking or sideloading.
Aug 18, 2026
A publicly disclosed zero-day in the Windows Steam Client Service (`steamservice.exe`), dubbed **BrokenPipe**, can let a standard local user execute attacker-controlled code as `NT AUTHORITY\SYSTEM`. The flaw reportedly exploits a signature-coverage gap in Steam’s installation-script workflow: the privileged service accepts a legitimate Valve-signed VDF file together with a caller-controlled installation-root path, enabling a malicious launcher placed at that location to run with SYSTEM privileges. Researcher KillaBoi published a proof of concept reportedly effective against Steam version `10.96.30.42` on 64-bit Windows 10 and Windows 11, and stated Valve had been aware of the issue since March 2026. Exploitation requires prior local code execution and an installed, available Steam service, making it a post-compromise privilege-escalation vector rather than a remote entry point. No public Valve advisory, CVE, or confirmed remediation was available; organizations should review Steam installations and investigate SYSTEM-level child processes launched by `steamservice.exe`, particularly where executables originate from user-writable paths.
Sep 18, 2026