CVE-2026-49795

This is a Windows “coding mistake” in the core of the operating system. It can let a person who already has a limited local account on a machine “step up” to full admin/system control, like getting the keys to the building even if they started with a basic access badge.

This matters if you run or administer Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, or Windows Server 2025 on devices where an attacker could get local, low-privileged access. The risk is mainly for situations like shared/guest machines, poorly controlled contractor accounts, or any scenario where someone untrusted can sign in locally.

The vulnerability requires local access and low privileges, so it is typically a risk only if it is reachable through local logins/account access—not by just visiting a website.

Mark this as high urgency for affected Windows systems because it’s a kernel-level flaw that can directly convert limited local access into full system control. Even if there’s no confirmed public exploit code, the impact is severe and attackers who can get local footholds commonly target this kind of escalation.

Because the verdict is RED, patching should be prioritized immediately for machines that might be exposed to untrusted local access.