Public PoC Exploit Released for High-Severity Windows NT Kernel Privilege Escalation Flaw (CVE-2026-42980)
A proof-of-concept (PoC) exploit for CVE-2026-42980, a high-severity local privilege escalation vulnerability in the Windows NT OS Kernel, has been publicly released. The flaw stems from an integer underflow in kernel-mode code, allowing a locally authenticated attacker with low privileges to execute arbitrary code with SYSTEM-level access.
The vulnerability enables attackers to escalate privileges from a standard user account to NT AUTHORITY\SYSTEM, granting full control over affected Windows systems. Exploitation requires no user interaction, making it a prime target for post-compromise attacks, including lateral movement and disabling security controls.
Security researcher G4sp4rCS published the PoC on GitHub, including source code, build scripts, and a technical writeup. The exploit targets a vulnerable WMI-related kernel path and is designed for educational and defensive research in isolated environments. Microsoft has released a patch as part of its regular security updates, urging administrators to apply fixes immediately.
With public exploit code now available, the risk of weaponization has increased, particularly in scenarios where attackers gain initial access via phishing, malware, or browser exploits. Organizations are advised to prioritize patching, especially on multi-user and terminal servers, and restrict local logon rights to mitigate exposure. Monitoring for suspicious privilege escalation attempts is also recommended.
Source: https://cybersecuritynews.com/poc-windows-nt-os-kernel/
Microsoft TPRM report: https://www.rankiteo.com/company/microsoft-security
"id": "mic1784744777",
"linkid": "microsoft-security",
"type": "Vulnerability",
"date": "7/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'type': 'Operating System'}],
'attack_vector': 'Local',
'description': 'A proof-of-concept (PoC) exploit for CVE-2026-42980, a '
'high-severity local privilege escalation vulnerability in the '
'Windows NT OS Kernel, has been publicly released. The flaw '
'stems from an integer underflow in kernel-mode code, allowing '
'a locally authenticated attacker with low privileges to '
'execute arbitrary code with SYSTEM-level access. The '
'vulnerability enables attackers to escalate privileges from a '
'standard user account to NT AUTHORITY\\SYSTEM, granting full '
'control over affected Windows systems. Exploitation requires '
'no user interaction, making it a prime target for '
'post-compromise attacks, including lateral movement and '
'disabling security controls.',
'impact': {'operational_impact': 'Full system compromise, lateral movement, '
'disabling security controls',
'systems_affected': 'Windows systems with vulnerable NT Kernel'},
'post_incident_analysis': {'corrective_actions': 'Apply Microsoft security '
'patch, restrict local logon '
'rights, monitor for '
'privilege escalation '
'attempts',
'root_causes': 'Integer underflow in Windows NT '
'Kernel (WMI-related kernel path)'},
'recommendations': 'Prioritize patching, especially on multi-user and '
'terminal servers. Restrict local logon rights to mitigate '
'exposure. Monitor for suspicious privilege escalation '
'attempts.',
'references': [{'source': 'GitHub (G4sp4rCS)'}],
'response': {'containment_measures': 'Apply Microsoft security patch, '
'restrict local logon rights',
'enhanced_monitoring': 'Monitor for suspicious privilege '
'escalation attempts',
'remediation_measures': 'Patch vulnerable systems, monitor for '
'suspicious privilege escalation '
'attempts'},
'title': 'Public PoC Exploit Released for High-Severity Windows NT Kernel '
'Privilege Escalation Flaw (CVE-2026-42980)',
'type': 'Privilege Escalation',
'vulnerability_exploited': 'CVE-2026-42980 (Integer underflow in Windows NT '
'Kernel)'}