ThreatCluster

Multiple CVEs Affect Windows Services with Elevation of Privileges

First seen 11 Sep 2026, 18:03 UTC • •46

Article Content

1 / 5

Browse articles

ThreatCluster •September 12, 2026 at 17:28 UTC

•CVE-2026-61349 allows elevation to SYSTEM privileges in Windows Work Folder Service.
•CVE-2026-54124 enables unauthorized code execution in Windows Terminal.
•Both vulnerabilities have patches available; users should update immediately.

Two critical vulnerabilities, CVE-2026-61349 and CVE-2026-54124, were disclosed by Microsoft on September 11, 2026. CVE-2026-61349, a use-after-free vulnerability in the Windows Work Folder Service, allows an authorized attacker to elevate privileges to SYSTEM level. CVE-2026-54124, an integer overflow vulnerability in Windows Terminal, enables unauthorized code execution locally. Both vulnerabilities have been acknowledged and updated in Microsoft's advisory. The vulnerabilities affect various Windows services, posing significant risks to users and organizations. Microsoft has released updates to mitigate these issues, and users are urged to apply them promptly. The current status indicates no active exploitation reported as of the latest update.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 44d ago How this analysis works

Timeline

2026-07-14

CVE-2026-54124 published

Microsoft disclosed an integer overflow vulnerability in Windows Terminal that allows unauthorized code execution.

Api.Msrc.Microsoft

2026-08-11

CVE-2026-61349 published

Microsoft disclosed a use-after-free vulnerability in Windows Work Folder Service, allowing privilege escalation.

Api.Msrc.Microsoft

2026-09-11

Vulnerabilities updated

Microsoft updated its advisory for both CVEs, confirming the release of patches and mitigation recommendations.

Api.Msrc.Microsoft

More articles in this cluster (4)

Threat Graph

10 entities, 12 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (2)

Privilege Escalation
T1068 - Exploitation for Privilege Escalation

Weakness (4)

CWE-122 - Heap-based Buffer Overflow
CWE-190 - Integer Overflow Or Wraparound
CWE-362 - Race Condition
CWE-416 - Use After Free

Affected Platform (2)

Windows
Windows Terminal

Vulnerability (2)

Race Condition
Use After Free

Relationships

Race Condition targets Windows
Race Condition targets Windows Terminal
Use After Free targets Windows
Use After Free targets Windows Terminal
Privilege Escalation targets Windows
Privilege Escalation targets Windows Terminal
T1068 - Exploitation for Privilege Escalation targets Windows
T1068 - Exploitation for Privilege Escalation targets Windows Terminal
Race Condition related to CWE-122 - Heap-based Buffer Overflow
Race Condition related to CWE-190 - Integer Overflow Or Wraparound
Race Condition related to CWE-362 - Race Condition
Race Condition related to CWE-416 - Use After Free

Continue Reading

PHP2Shell Vulnerabilities Exploited by AI-Driven Attackers Threat actors have exploited PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) to target a government entity in Europe, gaining access to sensitive data within two hours of the initial breach. The attackers utilized AI tools for reconnaissance and post-exploitation activities, including accessing…

Lazarus APT Launches Operation FlashHole Using AI and Post-Quantum Cryptography Kaspersky has identified a cyberespionage campaign, dubbed Operation FlashHole, attributed to the Lazarus APT group, active since July 2025. The campaign has targeted at least three organizations in South Korea's construction, software, and wire-communication sectors. Attack methods include spear-phishing emails…