CVE-2026-27914
Improper Access Control in Microsoft Management Console Enables Privilege Escalation
Publication date: 2026-04-14
Last updated on: 2026-04-22
Assigner: Microsoft Corporation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| microsoft | windows_server_2012 | r2 |
| microsoft | windows_server_2012 | * |
| microsoft | windows_10_1607 | to 10.0.14393.9060 (exc) |
| microsoft | windows_10_1607 | to 10.0.14393.9060 (exc) |
| microsoft | windows_10_1809 | to 10.0.17763.8644 (exc) |
| microsoft | windows_10_1809 | to 10.0.17763.8644 (exc) |
| microsoft | windows_10_21h2 | to 10.0.19044.7184 (exc) |
| microsoft | windows_10_21h2 | to 10.0.19044.7184 (exc) |
| microsoft | windows_10_21h2 | to 10.0.19044.7184 (exc) |
| microsoft | windows_10_22h2 | to 10.0.19045.7184 (exc) |
| microsoft | windows_10_22h2 | to 10.0.19045.7184 (exc) |
| microsoft | windows_10_22h2 | to 10.0.19045.7184 (exc) |
| microsoft | windows_11_23h2 | to 10.0.22631.6936 (exc) |
| microsoft | windows_11_23h2 | to 10.0.22631.6936 (exc) |
| microsoft | windows_11_24h2 | to 10.0.26100.8246 (exc) |
| microsoft | windows_11_24h2 | to 10.0.26100.8246 (exc) |
| microsoft | windows_11_25h2 | to 10.0.26200.8246 (exc) |
| microsoft | windows_11_25h2 | to 10.0.26200.8246 (exc) |
| microsoft | windows_11_26h1 | to 10.0.28000.1836 (exc) |
| microsoft | windows_11_26h1 | to 10.0.28000.1836 (exc) |
| microsoft | windows_server_2016 | to 10.0.14393.9060 (exc) |
| microsoft | windows_server_2019 | to 10.0.17763.8644 (exc) |
| microsoft | windows_server_2022 | to 10.0.20348.5020 (exc) |
| microsoft | windows_server_2022_23h2 | to 10.0.25398.2274 (exc) |
| microsoft | windows_server_2025 | to 10.0.26100.32690 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an improper access control issue in Microsoft Management Console that allows an authorized attacker to elevate their privileges locally.
How can this vulnerability impact me? :
An attacker who already has some level of access to the system can exploit this vulnerability to gain higher privileges. This can lead to full control over the affected system, allowing the attacker to compromise confidentiality, integrity, and availability.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, apply the security updates provided by Microsoft for the Microsoft Management Console as soon as possible.
Since the vulnerability allows local privilege escalation, ensure that only trusted users have local access to affected systems until the update is applied.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows an authorized attacker to elevate privileges locally due to improper access control in Microsoft Management Console.
Elevation of privilege vulnerabilities can potentially lead to unauthorized access to sensitive data or system functions, which may impact compliance with standards such as GDPR and HIPAA that require strict access controls and protection of sensitive information.
However, specific impacts on compliance with these regulations are not detailed in the provided information.