CVE-2026-66804

CVE-2026-66804 is an improper access control vulnerability (CWE-284) in the Windows Cross Device Service, a component shipped with Microsoft Windows 10 and Windows 11. An attacker who already holds a low-privileged account on the local machine can trigger the flaw without any user interaction, abusing the service's misassigned permissions. Successful exploitation elevates the attacker's privileges locally, yielding high-impact confidentiality, integrity, and availability access that typically means full control of the host (CVSS 7.8, AV:L/PR:L/UI:N). Any desktop or laptop running Windows 10 22H2 or Windows 11 24H2, 25H2, or 26H1 is affected. No exploitation has been observed so far - there is no public PoC and the flaw is not in CISA KEV - though EPSS estimates a 5.3% chance of exploitation within 30 days (92nd percentile), and a separate, similarly-classed Windows service LPE (MIDI Service, tracked as ZDI-26-617) was disclosed alongside it.

What to do: Apply Microsoft's security update for the affected builds via Windows Update, WSUS, or Intune as soon as it is released, prioritizing shared workstations, kiosks, and multi-user hosts where low-privileged local sessions are common. No public workaround or PoC is currently known, so until systems are patched, monitor Microsoft advisories and treat anomalous Cross Device Service activity as suspicious.