CVE-2026-72958 – Windows Credential Guard Elevation of Privilege Vulnerability

CVE-2026-72958 is a Critical elevation-of-privilege vulnerability in Windows Credential Guard caused by a double-free weakness. An authorized local attacker who successfully exploits the flaw could gain Virtual Trust Level 1 (VTL1) privileges. Exploitation requires high existing privileges and no user interaction. The vulnerability is not publicly disclosed and is not known to be exploited.

CVSS SCORE: 8.2.

SEVERITY: Critical.

THREAT: A local attacker with high privileges could exploit the vulnerability to elevate privileges to VTL1. Successful exploitation could have a high impact on confidentiality, integrity, and availability.

EXPLOITS: The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is listed as unproven, and exploitation is assessed as unlikely. No confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified.

TECHNICAL SUMMARY: The vulnerability is a double-free memory-management weakness (CWE-415) in Windows Credential Guard. It can allow an authorized attacker operating locally to elevate privileges. The CVSS metrics specify a local attack vector, high privileges required, no user interaction, and changed scope. Successful exploitation can grant VTL1 privileges, with high potential impact to confidentiality, integrity, and availability. The executive summary states that exploitation requires winning a race condition, although the supplied CVSS metrics list attack complexity as Low.

EXPLOITABILITY: Affected systems are Windows 11 versions 24H2, 25H2, and 26H1 on ARM64 and x64, plus Windows Server 2025, including Server Core installations. Exploitation requires local access with high privileges and no user interaction.

BUSINESS IMPACT: Successful exploitation could enable an attacker with existing privileged local access to gain VTL1 privileges. This creates serious risk to sensitive information, system integrity, and service availability. In an enterprise environment, additional privilege gained on a compromised endpoint or server can increase the potential impact of an existing security breach.

WORKAROUND: No mitigations or workarounds are identified. An official fix is listed, and affected updates require a restart.

URGENCY: This vulnerability is rated Critical and can result in VTL1 privilege elevation with high confidentiality, integrity, and availability impact. Although exploitation is assessed as unlikely and no exploitation is currently identified, affected Windows 11 and Windows Server 2025 systems should receive the official security fix promptly.