Skip to content
New 'Plug and Pwn' Attacks Exploit Windows for SYSTEM Access

New 'Plug and Pwn' Attacks Exploit Windows for SYSTEM Access

First seen 12 Aug 2026, 19:07 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •August 13, 2026 at 18:23 UTC
  • •New 'Plug and Pwn' attacks exploit Windows Plug and Play for SYSTEM access.
  • •Attacks can occur without user interaction, including remote execution over RDP.
  • •Organizations should restrict device installations and disable unnecessary RDP features.

Security researchers Alejandro Hernando and Borja Martínez unveiled 'Plug and Pwn' attacks at DEF CON 34, exploiting Windows Plug and Play features to gain SYSTEM privileges. These attacks can trick Windows into installing vulnerable vendor software without user interaction, including a zero-click variant that operates over RDP. The method involves emulating USB devices using tools like FaceDancer, leading to unauthorized software installations. Some attack chains can execute in as little as five minutes. Disabling co-installers may mitigate risks, but does not resolve the underlying vulnerability. Organizations are advised to implement device installation restrictions and disable unnecessary RDP PnP redirection. The attacks affect Windows 11 and could potentially impact other versions as well.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 60d ago How this analysis works

Timeline

2019-11-21
CVE-2019-10617 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-08-11
Remote variant of attack detailed
A remote attack variant over RDP was demonstrated, exploiting low-level USB redirection.
Feeds.4Sysops
2026-08-12
Plug and Pwn attacks disclosed
Researchers demonstrated attacks at DEF CON 34, exploiting Windows to gain SYSTEM privileges via USB emulation.
BleepingComputer
2026-08-12
Zero-click attack chain demonstrated
A zero-click attack chain was shown to execute in five minutes on Windows 11, leveraging RDP USB redirection.
Scworld

More articles in this cluster (5)

Following this threat?

Track CVE-2019-10617 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (15)

1 / 4