CVE-2026-55006

Microsoft Exchange Server vulnerability CVE-2026-55006: Insufficient granularity of access control enables local privilege escalation for an authorized attacker. Root cause: lack of fine-grained access controls. Impact: high confidentiality, integrity, and availability impact per CVSS 3.1 (AV:L/A...

CVE-2026-49170

CVE-2026-49170 affects the Windows StateRepository API server file due to insufficient granularity in access control, enabling an authorized local attacker to elevate privileges. Base metrics show CVSS v3.1: 7.8 (HIGH) with local access, low attack complexity, low privileges required, and no user...

Win32k Elevation of Privilege Vulnerability

Improper access control in Windows Win32K allows an authorized attacker to elevate privileges locally...

Win32k Elevation of Privilege Vulnerability

Improper access control in Windows Win32K allows an authorized attacker to elevate privileges locally...

Windows MIDI Service Module Elevation of Privileges Vulnerability

Improper access control in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally...

Windows Audio Compression Manager (ACM) Elevation of Privilege Vulnerability

Improper access control in Windows Audio Compression Manager ACM allows an authorized attacker to elevate privileges locally...

Windows Server Elevation of Privilege Vulnerability

Improper access control in Windows Server allows an authorized attacker to elevate privileges locally...

Windows Remote Help Defense Elevation of Privilege Vulnerability

Improper access control in Windows Remote Help Defense allows an authorized attacker to elevate privileges locally...

Active Directory Federation Services Elevation of Privilege Vulnerability

Insufficient granularity of access control in Active Directory Federation Services AD FS allows an authorized attacker to elevate privileges locally...

Windows StateRepository API Server file Elevation of Privilege Vulnerability

Insufficient granularity of access control in Windows StateRepository API allows an authorized attacker to elevate privileges locally...

Windows Search Service Elevation of Privilege Vulnerability

Improper access control in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally...

Windows Operating Systems Elevation of Privilege Vulnerability

Improper access control in Windows Operating Systems allows an authorized attacker to elevate privileges locally...

Windows DNS Client Tampering Vulnerability

Improper access control in Microsoft Windows DNS allows an authorized attacker to perform tampering locally...

Windows Kernel Elevation of Privilege Vulnerability

Improper access control in Windows Kernel allows an authorized attacker to elevate privileges locally...

Windows Event Logging Service Remote Code Execution Vulnerability

Insufficient granularity of access control in Windows Event Logging Service allows an authorized attacker to execute code over a network...

DNS Client Tampering Vulnerability

Improper access control in Microsoft Windows DNS allows an authorized attacker to perform tampering locally...

Windows Filtering Platform Elevation of Privilege Vulnerability

Insufficient granularity of access control in Windows Filtering Platform WFP allows an authorized attacker to elevate privileges locally...

Extensible Storage Engine (ESENT) Elevation of Privilege Vulnerability

Improper access control in Extensible Storage Engine ESENT allows an authorized attacker to elevate privileges locally...

Microsoft SharePoint Server Spoofing Vulnerability

Improper access control in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...

M365 Copilot for iOS Elevation of Privilege Vulnerability

Improper access control in Microsoft 365 Copilot for iOS allows an unauthorized attacker to elevate privileges over a network...