Do Son 
TL;DR
Microsoft patched CVE-2026-66804, an elevation of privilege flaw in the Windows Cross Device Service. A standard local user can gain SYSTEM privileges through a missing-path DLL planting trick. Full technical details and a proof-of-concept exploit are now public. Microsoft rates the bug Important with a CVSS score of 7.8.
- CVE: CVE-2026-66804
- CVSS: 7.8 (High · CVSSv3)
- Product: Microsoft Windows 10 Version 22H2
- Affected: 10.0.19045.0, 10.0.26100.0, 10.0.26200.0, 10.0.28000.0
- Impact: Microsoft Windows Cross Device Service Elevation of Privilege Vulnerability
- Status: No confirmed exploitation yet
- Patched in: 10.0.19045.7663, 10.0.26100.9168, 10.0.26200.9168, 10.0.28000.2704
- EPSS: 3.4% (30-day)
- Action: Update to 10.0.19045.7663, 10.0.26100.9168, 10.0.26200.9168, 10.0.28000.2704 now
Why It Matters
SYSTEM is the highest privilege level on Windows. This CVE-2026-66804 flaw lets an ordinary user reach it. Therefore any attacker with a foothold can take full control.
Microsoft shipped the fix in the August 2026 Patch Tuesday. Researcher Daniel Wade of nadsec published the disclosure. As a result, defenders now have working exploit details in the open.
How the Attack Works
Windows registers the Cross Device virtual-camera COM server under a ProgramData path. On a fresh Windows 11 install, that registration exists before the backing folder does.
A standard user then creates the missing C:\ProgramData\CrossDevice directory. Next, the user plants a malicious DLL where the COM server expects one. When the virtual camera starts, the Windows Camera Frame Server loads that DLL as LOCAL SERVICE.
The service token carries SeImpersonatePrivilege. Consequently, a GodPotato-style chain converts that privilege into a full SYSTEM token. Importantly, this is a missing-path issue, not an overwrite of a protected Microsoft DLL.
Affected Versions
The researcher validated the flaw on Windows 11 Pro 25H2, build 26200.8524. The vulnerable state requires the CrossDevice COM registration in HKLM while the target ProgramData path stays absent.
Systems where the DLL already exists with protected permissions are not exploitable by this planting path. Microsoft lists the issue among hundreds of flaws fixed in August 2026.
Patch and Mitigation Steps
First, install the August 2026 Windows security updates without delay. The official Microsoft advisory for CVE-2026-66804 confirms the fix and affected products.
Until you patch, limit local access on shared machines. You should also monitor for unexpected DLLs appearing under ProgramData paths. The full proof-of-concept and technical writeup live in the researcher’s public repository.
No in-the-wild exploitation of this specific CVE has been confirmed. Even so, the public PoC raises the urgency to patch now.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
