Microsoft Windows Connected Devices Platform Service: Local privilege escalation

Summary

A race condition in the Windows Connected Devices Platform Service allows an authorized local user to elevate privileges to SYSTEM. The attacker needs a low-privileged account or code already running on the affected machine. Attack complexity is high, and Microsoft marks the vulnerability as not exploited with unproven exploit code.

Affected

• Windows 10 Version 1809 and Windows Server 2019 (including Server Core): builds below 10.0.17763.9376
• Windows 10 Version 21H2: builds below 10.0.19044.7807
• Windows 10 Version 22H2: builds below 10.0.19045.7807
• Windows 11 Version 23H2: builds below 10.0.22631.7652
• Windows 11 Version 24H2 and 25H2, Windows 11 Version 26H2: builds below 10.0.26100.9711, 10.0.26200.9711 and 10.0.26300.9711 respectively
• Windows 11 Version 26H1: builds below 10.0.28000.3231
• Windows Server 2022: builds below 10.0.20348.5761
• Windows Server 2025 (including Server Core): builds below 10.0.26100.33650
• Note: the x86 and x64 builds differ between sources; check the MSRC product table.

Fixed in

• Install the Microsoft security update for October 2026 (build numbers listed under affected).
• Windows 10 1809 / Server 2019: 10.0.17763.9376 (verify the exact value per platform in the MSRC table).

Workaround

• No vendor-published workaround was retrievable.
• An unverified third-party source suggests disabling the Windows Connected Devices Platform Service if it is not required. Test before use and do not treat it as a replacement for the patch.

Exploitation

• Microsoft: not exploited, exploit code maturity Unproven.
• CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
• No public proof-of-concept or in-the-wild exploitation found in the research; CISA KEV status not verified directly.

Our recommendation

• Patch promptly on systems running Windows 10 1809 or Server 2019, which are often long-lived legacy systems.
• Patch other affected Windows versions in the normal update cycle, with terminal servers and multi-user hosts first.
• Check the MSRC page and CISA KEV again before closing the ticket.
• Monitor for unusual privilege escalation on hosts where users have local access.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide msrc.microsoft.com
• NVD record via Vulners vulners.com
• Microsoft advisory via Vulners (MSCVE) vulners.com
• OpenCVE entry app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 09:07.