CVE-2026-61925

Windows Installer is the part of Windows that handles installing and updating software. This bug is like a “bouncer” that mis-checks who is allowed to do what—so a person who already has limited access can trick the installer into performing actions at full administrator level. That can mean they read secret data, change files, or disrupt services.

This matters to you if you run or manage any of these Windows versions: Windows 10, Windows 11, and Windows Server 2012/2012 R2/2016/2019/2022/2025. The attack requires an attacker to already have low-privilege access on the machine (it’s not a simple “click a link to get in” internet attack), and it is triggered through Windows Installer behavior with no extra user interaction.

This is urgent because the flaw enables an attacker to move from low privileges to full administrative control on the same machine. Even though it’s a local privilege escalation (not internet-only), attackers associated with serious campaigns have shown interest in this class of weaknesses, and a patch exists for all affected branches.