CVE-2026-20941CWE-59

CVE-2026-20941

High · published January 13, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
40.1
In the wild
Unconfirmed
What it is

⚡ A sneaky miscalculation in link handling could let authorized attackers elevate their privileges—like a janitor suddenly getting keys to the executive suite! 🔓 Imagine a hotel where the staff can access all rooms just because they followed a poorly labeled map. That’s what this vulnerability does—it lets someone go beyond their assigned role and access sensitive areas of the system, all because of weak link resolution. If exploited, this vulnerability could allow an attacker to gain higher privileges on the system, potentially leading to unauthorized access to sensitive data and system control. It’s like giving someone the ability to change the entire hotel’s reservation system without the proper clearance—absolutely devastating!

Put simply

Imagine a hotel where the staff can access all rooms just because they followed a poorly labeled map. That’s what this vulnerability does—it lets someone go beyond their assigned role and access sensitive areas of the system, all because of weak link resolution. CVE-2026-20941 arises from improper link resolution before file access in the Host Process for Windows Tasks, allowing authorized users to elevate their privileges locally. This means that if an attacker gains access to a user account, they could exploit this flaw to perform unauthorized actions.

What to do

If exploited, this vulnerability could allow an attacker to gain higher privileges on the system, potentially leading to unauthorized access to sensitive data and system control. It’s like giving someone the ability to change the entire hotel’s reservation system without the proper clearance—absolutely devastating! To protect your systems, ensure you apply patches provided by Microsoft as soon as they become available. Review your user access levels and restrict permissions to only what is necessary. Regularly update your security protocols to minimize the risk of privilege escalation attacks. You've got this! Follow these steps and you’ll be on your way to locking down your system like a security pro! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00475 · 40.1th percentile
Weakness
CWE-59 · Improper Link Resolution Before File Access ('Link Following')
Published
2026-01-13T23:16Z
Affected products (5)
ProductVersionsFixed in
microsoft/windows_11_24h2< 10.0.26100.762310.0.26100.7623
microsoft/windows_11_24h2< 10.0.26100.762310.0.26100.7623
microsoft/windows_11_25h2< 10.0.26200.762310.0.26200.7623
microsoft/windows_11_25h2< 10.0.26200.762310.0.26200.7623
microsoft/windows_server_2025< 10.0.26100.3223010.0.26100.32230
References (1)
EPSS history
Timeline
  • 13 JAN 17:57Z
    Host Process for Windows Tasks Elevation of Privilege Vulnerability
    cvelistv5