Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally.
Priority
MEDIUM
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
RISING
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-08-12 | 1 | PoC1 |
| 2026-08-13 | 5 | Exploit1General1PoC3 |
| 2026-08-14 | 2 | General1PoC1 |
| 2026-08-18 | 5 | Patch1PoC4 |
| 2026-08-19 | 1 | PoC1 |
CVE-2026-66804 - Windows Cross Device Service LPE - Writeup & PoC Found another cool one! https://github.com/Rat5ak/CVE-2026-66804-CrossDevice-Service-EoP Not sure who found it first, but shoutout to them. Despite not being FTF, my mom thinks this one is cool, which is the only important metric 😎
Post summary
The post announces CVE-2026-66804, a Windows LPE vulnerability, and shares a GitHub link to a writeup and PoC.
CVE-2026-66804: PoC Gains SYSTEM on Windows 11 - https://securityonline.info/cve-2026-66804-system-privileges/
Post summary
The notice announces a proof‑of‑concept for CVE‑2026‑66804 that allows SYSTEM privilege escalation on Windows 11, but lacks direct exploit code, patch info, or evidence of active exploitation.
CVE-2026-66804 is an interesting Windows LPE. The PoC uses GodPotato to exploit the Windows Cross Device Service and escalate from a low-privileged user to SYSTEM. The chain is basically: Low-privileged process - interact with Cross Device Service - trigger the vulnerable behavior - GodPotato gets a privileged token - execute as "NT AUTHORITY\SYSTEM" What I find interesting here is how an existing privilege-escalation technique like GodPotato can be combined with a service-specific vulnerability to cross the privilege boundary. A good example of why Windows services and their security boundaries are worth looking at.
Post summary
The post details a PoC for CVE-2026-66804, showing how GodPotato exploits a Windows Cross Device Service flaw to achieve local privilege escalation to SYSTEM.
Just noticed this in the replay — our Windows 11 MIDI work made the @PwnieAwards 2026 Best Privilege Escalation Bug nominee list 🦄 CVE-2026-50342 + CVE-2026-66804 We call the pair DeadNote. https://t.co/L1uYkCq1AR
dangling COM registration. SYSTEM DLL load. CVE-2026-66804. incomplete fix for Dark Elevator. CrossDevice CLSID points at a DLL under ProgramData that does not exist. any user plants it. Forshaw loads it via custom COM marshaling. Shell Create Object Task starts dllhost as SYSTEM. custom marshal still on. ICreateObject takes the fake IMarshal. CLSID unmarshals. DLL runs. credit: James Forshaw / @ProjectZero https://projectzero.google/2026/09/windows-dangling-com.html #ExploitDev #WindowsSecurity #InfoSec
🚨 PoC RELEASED: Public exploit code is now available for CVE-2026-66804, a Windows Cross Device Service local privilege escalation flaw. The vulnerability affects Windows 10 22H2 and allows an authorized local attacker to elevate privileges through improper access control. 🔗 https://github.com/DavidCarliez/CVE-2026-66804-CrossDevice-LPE #Microsoft #Windows #CVE #LPE #PoC #CyberSecurity #Infosec
Post summary
Public exploit code for CVE‑2026‑66804, a Windows 10 22H2 local privilege escalation vulnerability, has been released via a GitHub repository; no patch or active exploitation details are included.
🔴 CVE-2026-66804 – Windows Cross Device Service'te kritik Local Privilege Escalation (LPE) açığı için Writeup ve PoC yayınlandı. Standart kullanıcı yetkisiyle C:\ProgramData\CrossDevice dizinine zararlı DLL plant edilerek Camera Frame Server üzerinden LOCAL SERVICE bağlamında kod çalıştırılabiliyor. SeImpersonatePrivilege kullanılarak GodPotato tarzı zincirle SYSTEM yetkilerine yükseltme mümkün. CVSS: 7.8 (HIGH) | Ağustos 2026 Patch Tuesday'de yamalandı. Writeup & PoC: https://github.com/Rat5ak/CVE-2026-66804-CrossDevice-Service-EoP
Post summary
A write‑up and proof‑of‑concept for CVE‑2026‑66804 have been released, detailing a local privilege escalation via a malicious DLL in the CrossDevice directory, with a vendor patch already issued for August 2026.
CVE-2026-66804 is a Windows local privilege-escalation bug (an incomplete fix for “Dark Elevator,” CVE-2026-50343) involving a dangling COM registration. A system-wide CLSID {E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496} (CrossDevice) pointed at a missing DLL under %PROGRAMDATA%\CrossDevice\.... Because ProgramData is user-writable, an attacker can plant a malicious DLL there. Instantiating that COM class then loads the DLL. The earlier InstallService path was patched, so exploitation used custom COM marshaling: a Custom OBJREF with that CLSID is sent to a privileged process that still allows custom unmarshaling. James Forshaw used the Shell Create Object Handler (dllhost as SYSTEM), started via the user-startable \Microsoft\Windows\Shell\CreateObjectTask scheduled task plus a global event, then passed a fake marshaled object through ICreateObject. Unmarshaling loads the planted DLL as SYSTEM. Microsoft has fixed the dangling registration. The post also notes the same marshaling trick can abuse other dangling COM classes or buggy custom unmarshalers, and includes a PowerShell scan to find similar missing in-proc servers. https://projectzero.google/2026/09/windows-dangling-com.html
CVE-2026-66804: dangling COM registration leads to SYSTEM in Windows Read on dbugs: https://dbu.gs/news/cve-2026-66804-dangling-com-registration-leads-to-system-in-windows-20260924 James Forshaw from Google Project Zero analyzed CVE-2026-66804 (https://dbu.gs/vulnerability/CVE-2026-66804) — an LPE in Windows caused by an incomplete fix for the earlier CVE-2026-50343 (https://dbu.gs/vulnerability/CVE-2026-50343) (Dark Elevator). The system retained a CrossDevice COM registration with the CLSID "{E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496}", pointing to a missing "%PROGRAMDATA%\CrossDevice\CrossDevice.Streaming.Source.dll". Because regular users can create directories under "C:\ProgramData", an attacker can plant their own DLL at the expected path. The main challenge is getting a privileged process to load it. Forshaw used custom COM marshaling: an object implementing "IMarshal" can specify an arbitrary CLSID to use during unmarshaling, causing the COM runtime to look up the corresponding in-process server and load its DLL. Exploitation therefore requires a privileged COM server that does not disable custom marshaling. Forshaw found one in the Shell Create Object Handler, hosted in "dllhost.exe" as "NT AUTHORITY\SYSTEM" with "CustomMarshalAllowed=True". A regular user can start the privileged server through the "\Microsoft\Windows\Shell\CreateObjectTask" scheduled task, after creating the global "ShellCreateObjectTaskReadyEvent" event. The attacker can then pass a specially crafted COM object to the "ICreateObject" interface. During unmarshaling, COM resolves the CrossDevice CLSID and loads the planted DLL from "%PROGRAMDATA%" into the SYSTEM process, resulting in privilege escalation. Forshaw published a fully working exploit. He also included a PowerShell script using "OleViewDotNet" and "NtObjectManager" to identify other registered in-process COM classes whose DLLs cannot be found by "LoadLibrary". The resulting paths must then be manually checked to determine whether an attacker can plant a DLL there. Forshaw notes that the same exploitation technique can simplify exploitation of other dangling COM registrations and can also be applied to buggy custom COM unmarshalers. Article: https://projectzero.google/2026/09/windows-dangling-com.html PoC: https://project-zero.issues.chromium.org/issues/538151139 CVE-2026-50343 — PT-2026-58331: https://dbu.gs/vulnerability/PT-2026-58331 CVE-2026-66804 — PT-2026-70703: https://dbu.gs/vulnerability/PT-2026-70703
A PoC/exploit has been discovered for vulnerability CVE-2026-66804 Vendor: Microsoft Product: Windows 10 Version 22H2 Description: Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally. Link: https://github.com/DavidCarliez/CVE-2026-66804-CrossDevice-LPE #dbugs_vuln
Post summary
A PoC/exploit for CVE-2026-66804 has been publicly disclosed with a GitHub repository, and the vulnerability is a local privilege escalation via improper access control in the Windows Cross Device Service.
GitHub - DavidCarliez/CVE-2026-66804-CrossDevice-LPE · GitHub - https://github.com/DavidCarliez/CVE-2026-66804-CrossDevice-LPE
Post summary
A GitHub repository titled "CVE-2026-66804-CrossDevice-LPE" contains a proof‑of‑concept exploit for a local privilege escalation vulnerability, but no active exploitation or patch information is disclosed.
Windowsの権限昇格脆弱性CVE-2026-66804が修正。一般ユーザがSYSTEM権限取得可能。C:\ProgramData\CrossDeviceフォルダを作成し、悪意あるDLLを設置し、COMサーバのWindows Camera Frame Serverから呼び出せばよい。PoC（攻撃の概念実証コード）あり。 https://securityonline.info/cve-2026-66804-system-privileges/
Post summary
CVE-2026-66804 is a privilege‑escalation flaw allowing users to obtain SYSTEM rights; a PoC exists involving DLL placement and COM invocation, and the vulnerability has already been patched by the vendor.
@moton hey das my writeup haha noice https://github.com/Rat5ak/CVE-2026-66804-CrossDevice-Service-EoP
Post summary
The tweet links to a GitHub write‑up for CVE‑2026‑66804, implying a PoC exists but provides no further exploit, mitigation, or active exploitation information.
A public PoC for CVE-2026-66804 escalates a standard Windows user to SYSTEM via the Cross Device Service. Details and exploit code are now disclosed. #CVE202666804 #PrivilegeEscalation #Windows11 #SYSTEMprivileges #EoP #PoCExploit https://securityonline.info/cve-2026-66804-system-privileges/
Post summary
A public PoC and exploit code for CVE-2026-66804 have been released, demonstrating privilege escalation to SYSTEM through the Cross Device Service.
CVE-2026-66804 is an incomplete fix for the "Dark Elevator" LPE bug, abusing a dangling COM registration for CrossDevice to plant a DLL and achieve SYSTEM via a mis-configured Shell Create Object Handler service. Key findings: - The root cause is a stale CLSID {E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496} registered system-wide pointing to %PROGRAMDATA%\CrossDevice\CrossDevice.Streaming.Source.dll, a path that does not exist but sits in C:\ProgramData, which any user can write to. Planting the DLL there is the primitive. - Execution into a privileged process abuses custom COM marshaling (T1559.001). A fake IMarshal implementation returns the dangling CLSID, and that Custom OBJREF is sent to the Shell Create Object Handler (CLSID 135fd325-45b7-4c30-89f8-4386961669f0), a dllhost running as NT AUTHORITY\SYSTEM with CustomMarshalAllowed: True. - The target service is not auto-started; an attacker first triggers the \Microsoft\Windows\Shell\CreateObjectTask scheduled task (accessible to normal users) and creates the global event ShellCreateObjectTaskReadyEvent to keep it alive, then calls ICreateObject::Proc3 passing the fake marshaled object to trigger unconditional unmarshaling and DLL load. - A PowerShell hunting script using OleViewDotNet can enumerate all in-process COM classes from the machine hive where LoadLibrary fails, surfacing other dangling registrations beyond CrossDevice. Patch CVE-2026-66804 immediately. #DFIR_Radar
#exploit #Red_Team_Tactics Windows Exploitation Techniques: Dangling COM Object Registrations https://projectzero.google/2026/09/windows-dangling-com.html // This post is about abusing a privilege escalation bug that Microsoft recently fixed in Windows 11 (CVE-2026-66804). https://www.cyberpocket.org https://t.co/4QWgbpoQ5b
A dangling COM object registration enables Windows privilege escalation (CVE-2026-66804), an incomplete Dark Elevator fix, found by James Forshaw. #cybersecurity #infosec #hacking #security #technology #vulnerability https://go.dft.red/r/z0n https://t.co/Xk6oA6zoTN
CVE-2026-66804 is what happens when a COM server gets uninstalled but the registry entry pointing to it does not. Windows elevation bugs are rarely about bypassing a check; they are about racing Windows to claim a dangling resource before the OS notices the server is gone.
🎯 Most likely to be exploited next (EPSS): • CVE-2026-15733 — EPSS 3.9% · CVSS 9.8 • CVE-2026-61358 — EPSS 3.3% · CVSS 8.8 • CVE-2026-66804 — EPSS 3% · CVSS 8.8 📄 Full weekly tables → https://github.com/notcve/reports/blob/main/weekly/2026-08-13.md
Post summary
The post lists three CVEs with high EPSS and CVSS scores but provides no evidence of current exploitation, PoC, or patch information.
James Forshaw at Project Zero details CVE-2026-66804, a Windows privilege escalation bug that is an incomplete fix for CVE-2026-50343, dubbed Dark Elevator by Calif. Forshaw and 14 others reported the issue.
9 of 9 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | microsoft | windows_10_22h2 | - | - | arm64 |
| OS | microsoft | windows_10_22h2 | - | - | x64 |
| OS | microsoft | windows_10_22h2 | - | - | x86 |
| OS | microsoft | windows_11_24h2 | - | - | arm64 |
| OS | microsoft | windows_11_24h2 | - | - | x64 |
| OS | microsoft | windows_11_25h2 | - | - | arm64 |
| OS | microsoft | windows_11_25h2 | - | - | x64 |
| OS | microsoft | windows_11_26h1 | - | - | arm64 |
| OS | microsoft | windows_11_26h1 | - | - | x64 |