Back Cybersecuritynews

Researchers Reveal ‘RegPwn,’ a Windows Registry Vulnerability That Granted SYSTEM Privileges

Cybersecuritynews •Abinaya • March 18, 2026

A high-severity Windows vulnerability dubbed “RegPwn” (CVE-2026-24291) is an elevation-of-privilege flaw that allows low-privileged users to gain full SYSTEM access. The MDSec red team discovered the vulnerability and successfully used it in internal engagements since January 2025, before it was addressed in a recent Microsoft Patch Tuesday update. The attack targets the way Windows manages […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

RegPwn: Critical Windows Registry Flaw Grants SYSTEM Access Researchers at MDSec have disclosed a critical Elevation of Privilege vulnerability in Microsoft Windows, identified as 'RegPwn' and tracked as CVE-2026-24291. This vulnerability allows low-privileged users to gain full SYSTEM access by exploiting the handling of registry configurations for Windows Accessibility features. The flaw was discovered during internal engagements by MDSec's red team, who have been aware of it since January 2025. Microsoft addressed the issue in a recent Patch Tuesday update on March 10, 2026. The flaw affects various Windows systems utilizing Accessibility features like the On-Screen Keyboard and Narrator. Security professionals are urged to apply the patch immediately to mitigate potential exploitation. The vulnerability has been classified as high severity due to its potential impact on system security. 2 sources 71

Extracted Entities

Researchers Reveal ‘RegPwn,’ a Windows Registry Vulnerability That Granted SYSTEM Privileges

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

MITRE ATT&CK (1)

Platforms (1)

Vulnerabilities (1)