CVE-2026-61358

ATBroker.exe is part of Windows accessibility features (the “accessibility infrastructure” used to support assistive tools). This vulnerability is a mistake in how Windows resolves file references, which can let a logged-in attacker use Windows itself to gain higher privileges.

Think of it like a locked door that accidentally follows the wrong address—if someone is already on your property, they may be able to use that mistake to get into restricted areas.

This matters if your business uses Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, or Windows Server 2025, especially on machines where an attacker may be able to run code as a legitimate user (for example after phishing or stolen credentials).

Because the weakness requires an “authorized attacker” locally, you should treat it as a serious patching priority if an attacker could already have a foothold on any affected endpoint or server, not as a purely remote risk.

This is RED because the weakness can be used to gain higher privileges locally, and there is press attention tied to patching activity. Even without public exploit code on record or KEV listing, the attacker model here is “someone already has a foothold,” which is a common real-world starting point.

Patch as soon as possible for all affected Windows versions, prioritizing systems that are more exposed to user-level compromise (remote users, email-heavy systems, and servers with interactive logins).