CVE-2026-96188

Awaiting Analysis Awaiting Analysis - Queue

External Control of System Configuration in Microsoft PowerToys

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: Microsoft Corporation

Description

External control of system or configuration setting in Microsoft PowerToys allows an authorized attacker to elevate privileges locally.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-96188

EUVD

EUVD-2026-100194

Affected Vendors & Products

Vendor	Product	Version / Range
Microsoft	Microsoft	PowerToys 0.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-15	One or more system settings or configuration elements can be externally controlled by a user.

Attack-Flow Graph

Executive Summary

This vulnerability is an elevation of privilege issue in Microsoft PowerToys. An authorized attacker with local access can exploit it to gain higher privileges on the system through external control of system or configuration settings.

Impact Analysis

If exploited, this vulnerability could allow an attacker to gain elevated privileges on your system. This means they could perform actions with higher permissions than intended, potentially leading to unauthorized access or control over your system.

Mitigation Strategies

Apply the latest security update from Microsoft for PowerToys as soon as possible to address the elevation of privilege vulnerability.

Hi! I’m here to help you understand CVE-2026-96188. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70