CVE-2026-59126

This flaw affects Windows’ Event Logging Service, which is responsible for recording important system and security events. If someone already has an account on the computer (even a standard one), they may be able to exploit timing behavior and “step up” to higher permissions—like getting the same power as an administrator. It’s like a lock that can sometimes be forced only if someone is already standing inside the building.

This matters if you run or manage Windows 10, Windows 11, Windows Server 2022, or Windows Server 2025 systems. Because the attacker needs valid low-level local access, it’s most relevant on machines where untrusted users (contractors, shared devices, or internal accounts) can sign in locally. It’s only a meaningful risk when a malicious party already has local credentials on the device (no remote-only trigger is indicated in the findings).

This is RED because the weakness enables local privilege escalation and your Windows machines can be targeted by anyone who already has an account on them. Even though there’s no confirmed public exploit code or dated proof of in-the-wild exploitation in the findings, Microsoft has issued fixes and this is being actively tracked as a new patch cycle item. Prioritize updating affected systems—especially those that face people who can log in locally.

To confirm exposure:

• Identify which affected OS each device runs (Windows 10, Windows 11, Windows Server 2022, Windows Server 2025).
• For each device, check its exact Windows build number (the “10.0.xxxxx.yyyyy” version shown in Windows System Information or the About page).
• Compare the device build to the fixed versions Microsoft lists for that specific OS.

Fixed versions to apply (upgrade so the installed build is at or above the fixed build for your branch):

• Windows 10: fixed in 10.0.19044.7663 and 10.0.19045.7663
• Windows 11: fixed in 10.0.22631.7517; 10.0.26100.9106; 10.0.26200.9106; 10.0.28000.2704; 10.0.26100.9168; 10.0.26200.9168
• Windows Server 2022: fixed in 10.0.20348.5440 and 10.0.20348.5499
• Windows Server 2025: fixed in 10.0.26100.33222 and 10.0.26100.33296

Upgrade path / notes:

• Use Microsoft Update / Windows Update (or your managed patch tool) to install the security update associated with CVE-2026-59126.
• After patching, verify the OS build number reflects the fixed build (not just “updates installed” in general).

Temporary workaround (if patching is delayed):

• Limit who can log in locally: remove or restrict standard user accounts that don’t need device access.
• Avoid sharing local sessions and ensure contractor/internal accounts are removed promptly after use.

What to monitor:

• If you have EDR/logging, look for signs of suspicious privilege changes shortly after local logons (for example, unusual administrative actions following standard-user activity). Use your normal incident procedures if anything unexpected appears.

KEV / due date:

• This CVE is not listed in the CISA KEV findings provided.

Severity/impact: Rated HIGH (CVSS 7.0 in the prompt). The underlying issue is a race condition due to improper synchronization in the Windows Event Logging Service (CWE-362). Mechanism: a local, low-privilege authenticated user can exploit timing during concurrent operations to elevate privileges.

Exploitation status: No KEV entry provided and no dated press claim of in-the-wild exploitation was found in the provided findings; no public exploit code is on record. However, patch coverage news indicates this was addressed in a Patch Tuesday cycle, and the vulnerability is associated with actor interest (PULSE mentions Lazarus group) even without confirmed public exploit details in the findings.

Attack vector & reachability: Local attack with no user interaction required. A key precondition is existing valid low-level credentials (already-authenticated local user). Default reachability in configuration is not stated in the findings.

EPSS: Reported as low (prediction shown in findings) with a flat trend; since KEV/news did not confirm exploitation here, the urgency reasoning in practice comes from the confirmed local privilege escalation weakness and the availability of a Microsoft fix.