Windows Sysinternals Process Monitor: Local privilege escalation
Summary
Microsoft Sysinternals Process Monitor contains an untrusted pointer dereference (CWE-822) that allows an authorized local user to elevate privileges. An attacker needs an existing low-privilege account on the affected system and cannot exploit the flaw remotely. Process Monitor is mainly installed on administrator workstations and servers, where a successful attack could lead to high confidentiality and integrity impact.
Affected
- Windows Sysinternals Process Monitor, versions 1.0 up to but not including v4.04 (per CNA record)
Fixed in
- Fixed version according to the CNA range: v4.04 (not confirmed by the vendor advisory; not verified)
- Latest stable release listed by Wikipedia: v4.12 (October 14, 2026)
- Check the MSRC advisory for the exact fixed build.
Workaround
Unknown. No vendor workaround found.
- Remove or replace old standalone copies of Process Monitor (e.g. in shared folders, portable tool kits or old Sysinternals Suite folders).
Exploitation
- Not known to be exploited in the wild (CISA SSVC: Exploitation none; Strix: KEV no).
- No public proof of concept found.
- EPSS is low (about 0.00346).
Our recommendation
- Update Process Monitor and the Sysinternals Suite to the latest release.
- Prioritise admin workstations, terminal servers and jump hosts where the tool is installed.
- Remove unused or outdated copies of the tool from the systems.
- Monitor for signs of exploitation and revisit the priority if exploitation is reported.
- Standard patch cycle is sufficient for most SMEs; this is not an emergency.
Information from Microsoft (Patch Tuesday October 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MSRC Security Update Guide (not retrieved; check directly) msrc.microsoft.com
- Vulners NVD record vulners.com
- Vulners CVElist record vulners.com
- Strix CVE record www.strix.ai
- Neowin: Sysinternals Suite www.neowin.net
- Wikipedia: Process Monitor en.wikipedia.org
- SonicWall: Microsoft October 2026 security bulletin coverage www.sonicwall.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 3 Nov 2026, 14:32.
Original description (NVD)
Untrusted pointer dereference in SysInternals allows an authorized attacker to elevate privileges locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.