Microsoft has published complete remediation details for CVE-2026-66804, an Important elevation-of-privilege vulnerability in Windows Cross Device Service. The record was released on August 11, 2026 and revised on August 14. It now identifies nine affected Windows product entries and maps each one to a security update and fixed OS build.
The flaw is not an unconfirmed or remotely exploitable issue. Microsoft describes it as improper access control: an authorized attacker with local, low-privilege access can exploit Windows Cross Device Service to elevate to SYSTEM. No user interaction is required, but the attacker must already be able to run code locally.
The verified security record
| Field | Microsoft's current data |
|---|---|
| Severity | Important |
| CVSS | 7.8 base / 6.8 temporal |
| Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
| Weakness | CWE-284: Improper Access Control |
| Attack requirements | Local access and low privileges; no user interaction |
| Successful impact | Elevation to SYSTEM with high confidentiality, integrity, and availability impact |
| Public disclosure | No |
| Known exploitation | No |
| Microsoft assessment | Exploitation More Likely |
| Customer action | Required: install the update mapped to the affected product |
“Exploitation More Likely” is Microsoft's forward-looking exploitability assessment. It does not mean Microsoft has observed attacks. The same record explicitly says the vulnerability is not publicly disclosed and not known to be exploited.
Affected products and exact fixes
Microsoft lists nine affected product entries. The architecture-specific entries matter because administrators should compare both the Windows release and system architecture with the applicable KB and resulting build.
| Affected product | Required update | Fixed build |
|---|---|---|
| Windows 11 version 26H1 for ARM64-based systems | KB5121000 | 10.0.28000.2704 |
| Windows 11 version 26H1 for x64-based systems | KB5121000 | 10.0.28000.2704 |
| Windows 11 version 24H2 for x64-based systems | KB5121003 | 10.0.26100.9168 |
| Windows 11 version 24H2 for x64-based systems (hotpatch) | KB5120994 | 10.0.26100.9106 |
| Windows 11 version 24H2 for ARM64-based systems | KB5121003 | 10.0.26100.9168 |
| Windows 11 version 24H2 for ARM64-based systems (hotpatch) | KB5120994 | 10.0.26200.9106 |
| Windows 11 version 25H2 for x64-based systems | KB5121003 or hotpatch KB5120994 | 10.0.26200.9168 or 10.0.26200.9106 |
| Windows 11 version 25H2 for ARM64-based systems | KB5121003 or hotpatch KB5120994 | 10.0.26200.9168 or 10.0.26200.9106 |
| Windows 10 version 22H2 for 32-bit systems | KB5120249 | 10.0.19045.7663 |
| Windows 10 version 22H2 for ARM64-based systems | KB5120249 | 10.0.19045.7663 |
| Windows 10 version 22H2 for x64-based systems | KB5120249 | 10.0.19045.7663 |
The table expands the hotpatch alternatives so the KB-to-build relationship is explicit. Microsoft's affected-product API contains nine product rows; several rows carry both a normal cumulative-update mapping and a hotpatch mapping.
What administrators should do
- Identify Windows 10 22H2, Windows 11 24H2, 25H2, and 26H1 devices covered by the product list above.
- Deploy the applicable Microsoft security update through the normal update-management channel.
- Confirm the installed KB and OS build after deployment. A device should meet the mapped fixed build or a later supported build.
- Give priority to shared workstations, developer endpoints, jump hosts, and other systems where a compromised low-privilege account would make SYSTEM access especially damaging.
- Continue monitoring the Microsoft record for revisions, but do not wait for a public exploit: Microsoft already marks customer action as required and rates exploitation as more likely.
There is no Microsoft-published workaround or mitigation that replaces the update. Disabling unrelated cross-device features is not a verified fix. The supported remediation is to install the update assigned to the affected Windows product and verify the resulting build.
Why the correction matters
The earlier version of this article incorrectly treated the MSRC entry as an empty advisory and said affected products, CVSS, weakness, KB mappings, and remediation were unavailable. Microsoft's current record contains all of those fields. This article has been corrected to reflect the authoritative vulnerability and affected-product data rather than preserving an outdated snapshot.
