CVE-2026-42902
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Improper authorization vulnerability in Microsoft PowerToys allows an authorized attacker to elevate privileges locally.
Risk Assessment
An attacker could bypass access control mechanisms and gain unauthorized privileges.
Recommendation
Update Microsoft PowerToys to the latest version available from Microsoft.
Other vulnerabilities in Microsoft PowerToys
See all- CVE-2026-96188High
A vulnerability involving external control of system or configuration settings in Microsoft PowerToys allows an authenticated attacker to elevate privileges locally. The flaw enables configuration manipulation by an unauthorized source.
- CVE-2026-83681Medium
Weak authentication in Microsoft PowerToys allows an authorized attacker to perform tampering locally.
Original NVD description (English source)
Improper authorization in Microsoft PowerToys allows an authorized attacker to elevate privileges locally.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS