Loading vulnerability…
Windows Storage Spaces Controller Elevation of Privilege Vulnerability
CVE-2026-27907 is an elevation of privilege vulnerability in Windows Storage Spaces Controller caused by an integer underflow. The flaw arises from improper handling of arithmetic operations that can wrap below the minimum expected value, creating conditions that can be leveraged by a locally authenticated attacker. Microsoft classified the issue as CWE-191. Successful exploitation allows privilege escalation on the local system, and available reporting indicates the attacker can obtain SYSTEM privileges. The vulnerability is rated Important and has CVSS v3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows a locally authenticated attacker with low privileges to elevate privileges to SYSTEM. This can result in full compromise of the affected host, including high-impact access to confidentiality, integrity, and availability. An attacker gaining SYSTEM privileges could access protected data, modify system configuration or security controls, install or execute arbitrary payloads with maximum local privileges, and disrupt normal system operation.
If you can’t patch tonight, do this now.
No separate vendor workaround is identified in the available information. Mitigation is therefore centered on reducing opportunities for local exploitation until patches are applied: restrict local logon and code execution to trusted users, minimize assignment of low-privilege accounts on affected systems, enforce least privilege, and monitor for anomalous privilege-escalation activity involving Windows storage management components.
Patch, then assume compromise.
Apply the Microsoft security updates released on 2026-04-14 for affected Windows systems. Microsoft indicated that an official fix is available. Prioritize patching on systems where unprivileged or low-privileged local users can log on or execute code.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.