CVE-2026

Api.Msrc.Microsoft • September 11, 2026

We use optional cookies to improve your experience on our websites, such as through social media connections, and to display personalized advertising based on your online activity. If you reject optional cookies, only cookies necessary to provide you the services will be used. You may change your selection by clicking “Manage Cookies” at the bottom of the page. Privacy Statement Third-Party Cookies

Released: Aug 11, 2026

Last updated: Sep 11, 2026

CWE-416: Use After Free

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Please see Common Vulnerability Scoring System for more information on the definition of these metrics.

Use after free in Windows Work Folder Service allows an authorized attacker to elevate privileges locally.

The following table provides an exploitability assessment for this vulnerability at the time of original publication.

What privileges could be gained by an attacker who successfully exploited this vulnerability?

An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.

Younggi Park (grill66), SEC-agent team

To determine the support lifecycle for your software, see the Microsoft Support Lifecycle .

Security Hotpatch Update 

Updated an acknowledgement. This is an informational change only.

Information published.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple CVEs Affect Windows Services with Elevation of Privileges Two critical vulnerabilities, CVE-2026-61349 and CVE-2026-54124, were disclosed by Microsoft on September 11, 2026. CVE-2026-61349, a use-after-free vulnerability in the Windows Work Folder Service, allows an authorized attacker to elevate privileges to SYSTEM level. CVE-2026-54124, an integer overflow vulnerability in Windows Terminal, enables unauthorized code execution locally. Both vulnerabilities have been acknowledged and updated in Microsoft's advisory. The vulnerabilities affect various Windows services, posing significant risks to users and organizations. Microsoft has released updates to mitigate these issues, and users are urged to apply them promptly. The current status indicates no active exploitation reported as of the latest update. 2 sources 46

Extracted Entities

CVE-2026

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (2)

MITRE ATT&CK (1)

Platforms (1)

Vulnerabilities (2)