CVE-2026-66804
Microsoft Windows Cross Device Service Elevation of Privilege Vulnerability
- Published
- Aug 11, 2026
- Updated
- Sep 16, 2026
- Assigning CNA
- microsoft
- Evidence observed
- Aug 11, 2026
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLow · next 30 days
- Percentile
- 92.3%
- Model date
- Sep 21, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally.
Sources
4Local Windows privilege escalation PoC for CVE-2026-66804: plants a COM DLL in a missing path to abuse Camera FrameServer and impersonate SYSTEM.
Local privilege escalation PoC for Windows CVE-2026-66804 using CrossDevice DLL planting and SigmaPotato token impersonation to spawn a SYSTEM process.
CVE-2026-66804 Windows Cross Device virtual camera EoP - Standard user to SYSTEM
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.