Description
Insufficient granularity of access control in Windows StateRepository API allows an authorized attacker to elevate privileges locally.
Published: 2026-07-14
Score: 7.8 High
EPSS: 2.8% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Windows StateRepository API manages file access operations and its access control granularity is insufficient. A local user who already has some level of access can exploit this flaw, as reflected in CWE-285 (Improper Access Control) and CWE-1220 (File and Directory Permissions Misconfiguration).

Affected Systems

Microsoft Windows 10 versions 1809, 21H2, and 22H2; Microsoft Windows 11 versions 24H2, 25H2, and 26H1; Microsoft Windows Server 2019 (including Server Core installation), Windows Server 2022, and Windows Server 2025 (including Server Core installation).

Risk and Exploitability

The CVSS score of 7.8 and an EPSS score of 3% indicate a moderate probability of exploitation. The vulnerability is not listed in CISA’s KEV catalogue, suggesting no confirmed exploits are publicly known. Based on the description, the attack scenario requires an authenticated local user; the attacker can elevate privileges to system level without additional credentials. This could enable full control over the affected operating system versions.

Generated by OpenCVE AI on July 31, 2026 at 09:43 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Microsoft cumulative update that contains the fix for CVE-2026-49170.
  • Restrict access to the StateRepository API by disabling unnecessary services and applying the principle of least privilege to all users interacting with the API.
  • Monitor system logs for anomalous API calls and conduct regular local privilege escalation checks on affected systems.

Generated by OpenCVE AI on July 31, 2026 at 09:43 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 15 Jul 2026 12:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 14 Jul 2026 17:15:00 +0000

Type Values Removed Values Added
Description Insufficient granularity of access control in Windows StateRepository API allows an authorized attacker to elevate privileges locally.
Title Windows StateRepository API Server file Elevation of Privilege Vulnerability
First Time appeared Microsoft
Microsoft windows 10 1809
Microsoft windows 10 21h2
Microsoft windows 10 22h2
Microsoft windows 11 24h2
Microsoft windows 11 25h2
Microsoft windows 11 26h1
Microsoft windows Server 2019
Microsoft windows Server 2022
Microsoft windows Server 2025
Weaknesses CWE-1220
CWE-285
CPEs cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_21H2:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_22H2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_11_24H2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_25H2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_26H1:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*
Vendors & Products Microsoft
Microsoft windows 10 1809
Microsoft windows 10 21h2
Microsoft windows 10 22h2
Microsoft windows 11 24h2
Microsoft windows 11 25h2
Microsoft windows 11 26h1
Microsoft windows Server 2019
Microsoft windows Server 2022
Microsoft windows Server 2025
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C'}

Subscriptions

Microsoft Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2019 Windows Server 2022 Windows Server 2025
cve-icon MITRE

Status: PUBLISHED

Assigner: microsoft

Published:

Updated: 2026-07-30T20:22:13.172Z

Reserved: 2026-05-27T23:44:09.623Z

Link: CVE-2026-49170

cve-icon Vulnrichment

Updated: 2026-07-15T10:44:36.164Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T09:45:04Z

Weaknesses
  • CWE-1220

    Insufficient Granularity of Access Control

  • CWE-285

    Improper Authorization