CVE-2026-27914: Privilege Escalation in Microsoft Management Console
Platform
windows
Component
microsoft-management-console
Fixed in
10.0.28000.1836
CVE-2026-27914 describes an improper access control vulnerability within the Microsoft Management Console (MMC). This flaw allows an authenticated attacker to escalate their privileges locally, potentially leading to unauthorized access and control over the affected system. The vulnerability impacts Windows 10 versions ranging from 10.0.14393.0 through 10.0.28000.1836. Microsoft has released a patch in version 10.0.28000.1836 to address this issue.
Impact and Attack Scenarios
Successful exploitation of CVE-2026-27914 allows an attacker who already has some level of access to the system to gain significantly higher privileges. This could involve escalating from a standard user account to a system administrator account, granting them complete control over the machine. An attacker could then install malware, steal sensitive data, modify system configurations, or create new user accounts with elevated privileges. The blast radius extends to any data or resources accessible by the system administrator account, potentially impacting multiple users and applications. While the vulnerability requires authentication, the ease of privilege escalation makes it a significant security risk.
Exploitation Context
CVE-2026-27914 was published on April 14, 2026. Its severity is rated HIGH (CVSS 7.8). Currently, there are no publicly known exploits or active campaigns targeting this vulnerability. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, and an EPSS score is pending evaluation. Monitor security advisories and threat intelligence feeds for any updates regarding exploitation attempts.
Threat Intelligence
Exploit Status
EPSS
0.06% (19% percentile)
CVSS Vector
What do these metrics mean?
- Attack Vector
- Local — attacker needs a local shell or interactive session on the system.
- Attack Complexity
- Low — no special conditions required. Attacker can exploit reliably without depending on rare configurations or timing.
- Privileges Required
- Low — any valid user account is sufficient. Basic authenticated access required.
- User Interaction
- None — attack is automatic and silent. Victim does nothing: no click, no file open.
- Scope
- Unchanged — impact is limited to the vulnerable component itself.
- Confidentiality
- High — complete confidentiality loss. Attacker can read all data: credentials, keys, personal data.
- Integrity
- High — attacker can write, modify, or delete any data: databases, config files, or code.
- Availability
- High — complete crash or resource exhaustion. Full denial of service.
Affected Software
Weakness Classification (CWE)
Timeline
- Published
- Modified
- EPSS updated
Mitigation and Workarounds
The primary mitigation for CVE-2026-27914 is to upgrade to Windows 10 version 10.0.28000.1836 or later, which includes the security patch. If immediate patching is not possible, consider implementing least privilege principles to restrict user access and limit the potential impact of a successful attack. Review MMC configurations and permissions to ensure they adhere to security best practices. While a direct workaround isn't available, restricting access to MMC and its functionalities can reduce the attack surface. After upgrading, verify the fix by attempting to execute commands requiring elevated privileges with a standard user account; these commands should fail.
How to fix
Aplica las actualizaciones de seguridad proporcionadas por Microsoft para Windows 10. Estas actualizaciones corrigen la vulnerabilidad de control de acceso incorrecto en la Consola de Administración de Microsoft (MMC), previniendo la elevación de privilegios. Consulta la guía de actualización de Microsoft para obtener instrucciones detalladas.
Frequently asked questions
What is CVE-2026-27914 — Privilege Escalation in Microsoft Management Console?
CVE-2026-27914 is a vulnerability in Microsoft Management Console allowing an authenticated attacker to elevate privileges locally, potentially gaining full control of the system. It impacts Windows 10 versions 10.0.14393.0–10.0.28000.1836.
Am I affected by CVE-2026-27914 in Microsoft Management Console?
You are affected if you are running Windows 10 versions 10.0.14393.0 through 10.0.28000.1836 and have not yet upgraded to a patched version.
How do I fix CVE-2026-27914 in Microsoft Management Console?
Upgrade to Windows 10 version 10.0.28000.1836 or later to receive the security patch. Implement least privilege principles as an interim measure.
Is CVE-2026-27914 being actively exploited?
Currently, there are no publicly known exploits or active campaigns targeting CVE-2026-27914, but continuous monitoring is recommended.
Where can I find the official Microsoft advisory for CVE-2026-27914?
Refer to the official Microsoft Security Update Guide for CVE-2026-27914: [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27914](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27914)
Is your project affected?
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Try it now — no account
Upload any manifest (composer.lock, package-lock.json, WordPress plugin list…) or paste your component list. You get a vulnerability report instantly. Uploading a file is just the start: with an account you get continuous monitoring, Slack/email alerts, multi-project and white-label reports.
Drag & drop your dependency file
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...