Nine Windows Privilege Escalation Bugs Confirmed Exploited — Why the Quiet Ones Matter Most

Nine Windows local privilege-escalation and access-control vulnerabilities were confirmed exploited across CISA's Known Exploited Vulnerabilities catalogue over the past year, spanning the SMB client, kernel-level race conditions, use-after-free bugs, and several distinct February 2026 findings disclosed together in a single Patch Tuesday cycle.

Why nine separate local privilege-escalation bugs in one year isn't unusual, and why that's the actual point

None of these nine CVEs, taken individually, would generate much attention — every one requires some existing access before it can be exploited, and CVSS scores in the 4-to-8 range don't top most vulnerability dashboards next to a critical, unauthenticated remote code execution finding. That's precisely the pattern worth naming: privilege-escalation bugs in an operating system as widely deployed as Windows are a near-constant background rate, not an anomaly, and they matter collectively far more than any individual entry suggests, because they are the mechanism by which an attacker converts limited initial access into full system control.

The two February 2026 findings sharing a disclosure date — CVE-2026-21525 and CVE-2026-21533 — illustrate this well: routine Patch Tuesday cycles regularly include multiple privilege-escalation fixes addressing entirely different code paths, several of which go on to be independently confirmed as exploited later.

Why "requires prior access" doesn't mean "low real-world priority"

The realistic threat model for almost any organization already assumes some accounts or endpoints will be compromised at a limited privilege level, whether through phishing, credential exposure, or a separate lower-severity vulnerability. Once that initial foothold exists, these nine CVEs are exactly what converts it into something more damaging — a point made directly, with a concrete Windows/ADFS example, elsewhere in this series. The lesson generalizes: local privilege-escalation patching deserves a place in the urgent queue, not the "when convenient" queue, precisely because it's the second half of nearly every real-world intrusion chain.

What to check this week

Confirm your Windows patch cadence actually covers privilege-escalation fixes with the same discipline applied to remote code execution fixes. It's a common and understandable bias to prioritize the more dramatic-sounding vulnerability class, at the expense of the class that determines how far an attacker gets after initial access.

Audit SMB client configuration specifically, given CVE-2025-33073's relatively high 8.8 score within this set and SMB's long history as a valuable lateral-movement and privilege-escalation vector.

Treat any endpoint with a large patch gap on privilege-escalation fixes as a higher-priority target for compromise-assessment, since an unpatched endpoint here is precisely where an attacker with any existing foothold would look next.

A closing note on measuring what actually matters

A patch-compliance dashboard reporting only "percentage of critical CVEs remediated" can look healthy while a real gap persists in this quieter privilege-escalation category; it's worth confirming your own metrics explicitly track this class of finding rather than letting it disappear into an aggregate score dominated by higher-profile remote code execution counts.

A final consideration on server versus workstation prioritization

Because privilege escalation on a domain-joined server typically carries far more consequence than the same bug on an isolated workstation, patch-prioritization logic for this category specifically should weight server roles more heavily than a flat, fleet-wide patch percentage target would otherwise suggest.

How Safeguard helps

Safeguard's continuous inventory tracks the full range of confirmed-exploited vulnerabilities against deployed operating systems, including the local privilege-escalation findings that individually look unremarkable but collectively define how far an initial compromise can spread — visibility that matters as much for this quieter category of vulnerability as it does for any single dramatic remote code execution finding.