Security researchers have discovered a critical zero-day vulnerability affecting all modern versions of Windows, allowing attackers to gain SYSTEM privileges.
Security researchers at a leading cybersecurity firm have uncovered a critical zero-day vulnerability in the Windows kernel that affects all modern versions of the operating system. The flaw, which has been assigned a CVSS score of 9.8 (Critical), allows local attackers to escalate their privileges to SYSTEM level without any user interaction.
The vulnerability was discovered during routine penetration testing of enterprise environments. Researchers immediately reported the finding to Microsoft through responsible disclosure channels. Microsoft has confirmed the vulnerability and is working on an emergency patch.
Organizations are urged to implement workarounds immediately while waiting for the official patch. Security teams should monitor endpoints for unusual privilege escalation attempts and review access logs for signs of exploitation.
The vulnerability affects Windows 10, Windows 11, Windows Server 2019, and Windows Server 2022. Earlier versions of Windows that are no longer supported may also be affected but will not receive patches.
Security professionals recommend isolating affected systems from sensitive network segments until the patch is available and tested. Additional monitoring for unusual SYSTEM-level process creation is strongly advised.