CVE-2026-26184: 
vulnerability analysis and mitigation

CVE-2026-26184 is a buffer over-read vulnerability in the Windows Projected File System (ProjFS) component that allows a locally authenticated, low-privileged attacker to elevate privileges on the affected system. Disclosed on April 14, 2026, as part of Microsoft's Patch Tuesday release, it affects a broad range of Windows versions including Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), Windows Server 2019, Windows Server 2022, Windows Server 2022 23H2, and Windows Server 2025. The vulnerability carries a CVSS v3.1 base score of 7.8 (High) (Microsoft MSRC).

The root cause is classified as CWE-126 (Buffer Over-read) within the Windows Projected File System driver. An authorized local attacker with low privileges can trigger the buffer over-read condition, which may expose sensitive kernel memory contents and be leveraged to escalate privileges to SYSTEM level. Exploitation requires no user interaction and has low attack complexity, making it straightforward for any local user account to attempt. No public technical write-ups or proof-of-concept code have been identified at this time (Microsoft MSRC).

Successful exploitation allows a low-privileged local user to escalate to SYSTEM-level privileges, granting complete control over the affected Windows host. This impacts confidentiality, integrity, and availability at a high level, as an attacker with SYSTEM access can read or modify any data, install malware, disable security controls, or pivot to other systems on the network. The wide scope of affected products — spanning consumer and enterprise Windows editions — significantly broadens the potential attack surface (Microsoft MSRC).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Microsoft MSRC). The EPSS score is approximately 0.06%, indicating a low near-term probability of exploitation. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

Microsoft released patches on April 14, 2026. Administrators should update affected systems to the following minimum build versions: Windows 10 1809 / Server 2019 → 10.0.17763.8644; Windows 10 21H2 → 10.0.19044.7184; Windows 10 22H2 → 10.0.19045.7184; Windows Server 2022 → 10.0.20348.5020; Windows Server 2022 23H2 → 10.0.25398.2274; Windows 11 23H2 → 10.0.22631.6936; Windows 11 24H2 / Server 2025 → 10.0.26100.8246 (client) / 10.0.26100.32690 (server); Windows 11 25H2 → 10.0.26200.8246; Windows 11 26H1 → 10.0.28000.1836. As a defense-in-depth measure, organizations should enforce the principle of least privilege to limit local user accounts and monitor for anomalous privilege escalation activity (Microsoft MSRC).

The vulnerability was noted in April 2026 Patch Tuesday roundups by security vendors including Rapid7 and Sophos, as well as asset management platform Lansweeper, all of which highlighted it as part of a broader monthly update. No significant independent researcher commentary or social media discussion specific to this CVE has been identified, consistent with its low EPSS score and absence of public exploit code.