Vulnerability record

CVE-2026-66804

HighNo known exploitation

Patch status

Official fix available since Sep 29, 2026

Apply the vendor's update to every affected system. Check the fixed-in versions below where known.

Basis: NVD patch reference

Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally.

Source: NIST National Vulnerability Database. Official vulnerability data, reproduced as published.

Developments from the last 30 days, newest first.

CVSS scoredUpdateSep 29, 2026
CVE-2026-66804 scored CVSS 7.8
Basis: NIST National Vulnerability Database
Patch releasedUpdateSep 29, 2026
Patch released for CVE-2026-66804
An official fix is now available.
Basis: NVD patch reference
DisclosedSep 20, 2026
Windows Exploitation Techniques: Dangling COM Object Registrations
Basis: Google Project Zero (security research)

HighPatch

Patch

Apply the vendor's security update for Windows.

Google Project Zero15 days agoHomeSMBEnterprise+1

msrc.microsoft.com https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-66804