CVE-2026-96188

HighCVSS 7.3

Published: 13/10/2026(UTC)Updated: 13/10/2026(UTC)Translated: 14/10/2026(UTC)NVD NIST

Summary

A vulnerability involving external control of system or configuration settings in Microsoft PowerToys allows an authenticated attacker to elevate privileges locally. The flaw enables configuration manipulation by an unauthorized source.

Risk Assessment

An authenticated attacker could alter critical settings, potentially leading to privilege escalation and system security breach.

Recommendation

It is recommended to update Microsoft PowerToys to the latest version containing the security fix.

Other vulnerabilities in Microsoft PowerToys

See all

CVE-2026-83681Medium
Weak authentication in Microsoft PowerToys allows an authorized attacker to perform tampering locally.
CVE-2026-42902High
Improper authorization vulnerability in Microsoft PowerToys allows an authorized attacker to elevate privileges locally.

Original NVD description (English source)

External control of system or configuration setting in Microsoft PowerToys allows an authorized attacker to elevate privileges locally.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS