← All advisories

High severity7.8NVD Advisory· Published Jun 9, 2026· Updated Jun 12, 2026

CVE-2026-42902

CVE-2026-42902

Description

Improper authorization in Microsoft PowerToys allows an authorized attacker to elevate privileges locally.

Affected products

2

Microsoft/PowerToys2 versions
cpe:2.3:a:microsoft:powertoys:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:microsoft:powertoys:*:*:*:*:*:*:*:*range: <0.99.1
- (no CPE)

Patches

Vulnerability mechanics

References

1

msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42902nvdPatchVendor Advisory

News mentions

4

Patch Tuesday - June 2026
Rapid7 Blog · Jun 9, 2026
Microsoft June 2026 Patch Tuesday fixes 3 zero-day, 200 flaws
BleepingComputer · Jun 9, 2026
Microsoft June 2026 Patch Tuesday fixes 6 zero-days, 200 flaws
BleepingComputer · Jun 9, 2026
Microsoft Patch Tuesday June 2026 – 198 Vulnerabilities Fixed, Including 3 Zero-days
Cyber Security News · Jun 9, 2026