Back Feeds.4Sysops

A new Plug and Play Windows 11 attack

Feeds.4Sysops •IT News • August 11, 2026

A new Plug and Play attack chain turns Windows 11’s automatic USB driver installation into SYSTEM-level code execution, even on a fully patched system. The researchers also demonstrated a remote variant over RDP when Plug and Play or low-level USB redirection is enabled. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

New 'Plug and Pwn' Attacks Exploit Windows for SYSTEM Access Security researchers Alejandro Hernando and Borja Martínez unveiled 'Plug and Pwn' attacks at DEF CON 34, exploiting Windows Plug and Play features to gain SYSTEM privileges. These attacks can trick Windows into installing vulnerable vendor software without user interaction, including a zero-click variant that operates over RDP. The method involves emulating USB devices using tools like FaceDancer, leading to unauthorized software installations. Some attack chains can execute in as little as five minutes. Disabling co-installers may mitigate risks, but does not resolve the underlying vulnerability. Organizations are advised to implement device installation restrictions and disable unnecessary RDP PnP redirection. The attacks affect Windows 11 and could potentially impact other versions as well. 3 sources 69

A new Plug and Play Windows 11 attack

The full story

Extracted Entities

MITRE ATT&CK (1)

Platforms (1)