CVE-2026-26152
Insecure Data Storage in Windows Crypto Service Enables Privilege Escalation
Publication date: 2026-04-14
Last updated on: 2026-04-24
Assigner: Microsoft Corporation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| microsoft | windows_server_2012 | r2 |
| microsoft | windows_server_2012 | * |
| microsoft | windows_10_1607 | to 10.0.14393.9060 (exc) |
| microsoft | windows_10_1607 | to 10.0.14393.9060 (exc) |
| microsoft | windows_10_1809 | to 10.0.17763.8644 (exc) |
| microsoft | windows_10_1809 | to 10.0.17763.8644 (exc) |
| microsoft | windows_10_21h2 | to 10.0.19044.7184 (exc) |
| microsoft | windows_10_21h2 | to 10.0.19044.7184 (exc) |
| microsoft | windows_10_21h2 | to 10.0.19044.7184 (exc) |
| microsoft | windows_10_22h2 | to 10.0.19045.7184 (exc) |
| microsoft | windows_10_22h2 | to 10.0.19045.7184 (exc) |
| microsoft | windows_10_22h2 | to 10.0.19045.7184 (exc) |
| microsoft | windows_11_23h2 | to 10.0.22631.6936 (exc) |
| microsoft | windows_11_23h2 | to 10.0.22631.6936 (exc) |
| microsoft | windows_11_24h2 | to 10.0.26100.8246 (exc) |
| microsoft | windows_11_24h2 | to 10.0.26100.8246 (exc) |
| microsoft | windows_11_25h2 | to 10.0.26200.8246 (exc) |
| microsoft | windows_11_25h2 | to 10.0.26200.8246 (exc) |
| microsoft | windows_11_26h1 | to 10.0.28000.1836 (exc) |
| microsoft | windows_11_26h1 | to 10.0.28000.1836 (exc) |
| microsoft | windows_server_2016 | to 10.0.14393.9060 (exc) |
| microsoft | windows_server_2019 | to 10.0.17763.8644 (exc) |
| microsoft | windows_server_2022 | to 10.0.20348.5020 (exc) |
| microsoft | windows_server_2022_23h2 | to 10.0.25398.2274 (exc) |
| microsoft | windows_server_2025 | to 10.0.26100.32690 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-922 | The product stores sensitive information without properly limiting read or write access by unauthorized actors. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, apply the security updates provided by Microsoft for Windows Cryptographic Services as soon as possible to prevent local privilege escalation.
Can you explain this vulnerability to me?
This vulnerability involves insecure storage of sensitive information within Windows Cryptographic Services. Because of this insecure storage, an authorized attacker who already has some level of access can exploit the vulnerability to elevate their privileges locally on the affected system.
How can this vulnerability impact me? :
The impact of this vulnerability is that an attacker with local access and some privileges can increase their level of access on the system. This elevation of privilege can lead to the attacker gaining higher-level permissions, potentially allowing them to perform unauthorized actions, access sensitive data, or compromise system integrity.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability involves insecure storage of sensitive information in Windows Cryptographic Services, which allows an authorized attacker to elevate privileges locally.
Such insecure handling of sensitive information and potential unauthorized privilege escalation could lead to violations of data protection requirements under standards like GDPR and HIPAA, which mandate strict controls over access to sensitive data.
However, the provided information does not explicitly detail the direct impact on compliance with these regulations.