CVE-2026-49170

Think of Windows as having “doors” for different services. This vulnerability is in a Windows service related to the StateRepository API, where the door doesn’t properly check whether the person using it should be allowed to do powerful actions.

If someone already has a basic (low-privilege) local account, they may be able to use this mistake to gain much higher privileges—like becoming an administrator or system-level user.

This matters if your business runs Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, or Windows Server 2025 on computers where users can log in with low-level privileges.

Because the flaw is local, it’s primarily a risk if an attacker can already get a foothold on the machine with limited access (local access is required), rather than from just reaching the device over the network.

This is a RED-priority issue because it allows a local attacker with limited privileges to elevate to administrator/system power.

Even without clear public reports of active exploitation, privilege-escalation weaknesses are high impact and are typically addressed through immediate patching because they can turn a minor compromise into full control.