CVE-2026-20941

Summary

Improper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized attacker to elevate privileges locally.

Affected Software

VendorProductVersion RangeStatus
MicrosoftWindows 11 Version 24H210.0.26100.0 < 10.0.26100.7623affected
MicrosoftWindows 11 Version 25H210.0.26200.0 < 10.0.26200.7623affected
MicrosoftWindows Server 202510.0.26100.0 < 10.0.26100.32230affected
MicrosoftWindows Server 2025 (Server Core installation)10.0.26100.0 < 10.0.26100.32230affected

Weaknesses

  • CWE-59: CWE-59: Improper Link Resolution Before File Access ('Link Following')

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References