CVE-2026-20941: 
vulnerability analysis and mitigation

CVE-2026-20941 is a local privilege escalation vulnerability in the Host Process for Windows Tasks (taskhostw.exe) caused by improper link resolution before file access (link following). Disclosed on January 13, 2026, as part of Microsoft's January 2026 Patch Tuesday, it affects Windows 11 versions 24H2 and 25H2 (x64 and ARM64) and Windows Server 2025, including Server Core installations. It carries a CVSS v3.1 base score of 7.8 (High), assigned by Microsoft (MSRC Advisory, Feedly).

The vulnerability is classified as CWE-59 (Improper Link Resolution Before File Access — 'Link Following'), a class of bugs commonly exploited via symbolic link (symlink) attacks (CAPEC-132). The Host Process for Windows Tasks fails to properly validate or resolve symbolic links before accessing files, allowing a low-privileged local attacker to redirect file operations to privileged locations. No user interaction is required, and attack complexity is low, meaning a standard local user account is sufficient to trigger the flaw. A technical write-up by MDSec published in February 2026 provides additional exploitation context (MDSec Blog).

A successfully exploited vulnerability allows a low-privileged local attacker to escalate privileges to SYSTEM level on affected Windows systems, resulting in high confidentiality, integrity, and availability impact. This enables full system compromise — including access to sensitive data, modification of system configurations, installation of persistent malware, and potential lateral movement within the network. Affected platforms include Windows 11 24H2, Windows 11 25H2, and Windows Server 2025 (including Server Core) (MSRC Advisory, Feedly).

As of the time of disclosure, no public proof-of-concept exploit code was confirmed available, and there is no evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.049% (0.000490), indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. However, MDSec published a technical blog post in February 2026 detailing exploitation mechanics, which may lower the barrier for threat actors (MDSec Blog).

1. Reconnaissance: Identify a target system running Windows 11 24H2, 25H2, or Windows Server 2025 with a low-privileged local user account. Confirm the system is unpatched (build below 10.0.26100.7623 for 24H2, 10.0.26200.7623 for 25H2, or 10.0.26100.32230 for Server 2025).
2. Identify vulnerable file operation: Analyze the Host Process for Windows Tasks (taskhostw.exe) to identify a file access operation that follows symbolic links without proper validation.
3. Create malicious symlink: As a low-privileged user, create a symbolic link (e.g., using CreateSymbolicLink or junction points) that redirects a file path accessed by the task host process to a privileged system location (e.g., a protected system directory or registry hive).
4. Trigger the vulnerable code path: Cause the Host Process for Windows Tasks to execute the vulnerable file access operation — this may occur automatically via a scheduled task or can be triggered by the attacker.
5. Achieve privilege escalation: The task host process follows the symlink and performs a privileged file operation (write, overwrite, or delete) on the attacker-controlled target path, enabling the attacker to plant a malicious payload or modify a privileged resource, ultimately achieving SYSTEM-level code execution (MDSec Blog, MSRC Advisory).

• Process: Unusual child processes spawned from taskhostw.exe (e.g., cmd.exe, powershell.exe, net.exe) with elevated privileges; taskhostw.exe accessing file paths outside its expected working directories.
• File System: Unexpected symbolic links or junction points created in user-writable directories pointing to system-protected paths; new or modified files in privileged directories (e.g., %SystemRoot%\System32) with timestamps correlating to task host activity.
• Logs: Windows Security Event Log entries showing privilege escalation (Event ID 4672 — Special privileges assigned to new logon) for accounts that should not hold elevated rights; Event ID 4688 showing unexpected process creation chains from taskhostw.exe.
• Registry: Unexpected modifications to HKLM registry keys by low-privileged user accounts, particularly around scheduled task configurations (HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule).

Microsoft released patches on January 13, 2026, as part of the January 2026 Patch Tuesday. Administrators should update to the following minimum builds: Windows 11 24H2 → 10.0.26100.7623; Windows 11 25H2 → 10.0.26200.7623; Windows Server 2025 → 10.0.26100.32230. No official configuration-based workaround has been published; patching is the only confirmed remediation. As a defense-in-depth measure, enforce the principle of least privilege and restrict local user accounts from creating symbolic links (via the SeCreateSymbolicLinkPrivilege policy) (MSRC Advisory, Feedly).

The Zero Day Initiative (Trend Micro) covered CVE-2026-20941 in their January 2026 Security Update Review, noting it as one of 114 flaws addressed in the January Patch Tuesday (ZDI Blog). BleepingComputer reported on the broader January 2026 Patch Tuesday release, which also included three zero-days (BleepingComputer). MDSec published a notable technical blog post in February 2026 titled "Total Recall: Retracing Your Steps Back to NT AUTHORITY\SYSTEM," which provided detailed exploitation analysis of this vulnerability (MDSec Blog). Sophos also covered the January 2026 Patch Tuesday in their security blog (Sophos Blog).