CVE-2026-21533

Microsoft Windows Improper Privilege Management (CVE-2026-21533)

Privilege Escalation Persistence Last updated:

Detects exploitation of CVE-2026-21533, a Microsoft Windows Improper Privilege Management vulnerability (CWE-269) listed in CISA's Known Exploited Vulnerabilities catalog. Successful exploitation allows a local attacker to elevate privileges on a compromised Windows system. Detection focuses on anomalous privilege token manipulation, unexpected service/process privilege escalation, and suspicious access patterns consistent with local privilege escalation techniques.

Vulnerability Intelligence

KEV — Known Exploited

Affected Software

Vendor
Microsoft
Product
Windows

Weakness (CWE)

CWE-269

Timeline

Disclosed
February 10, 2026

CVSS

7.8
High (7.0–8.9)

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Write-up coming soon

What is CVE-2026-21533 Microsoft Windows Improper Privilege Management (CVE-2026-21533)?

Microsoft Windows Improper Privilege Management (CVE-2026-21533) (CVE-2026-21533) maps to the Privilege Escalation and Persistence tactics — the adversary is trying to gain higher-level permissions in MITRE ATT&CK.

This page provides production-ready detection logic for Microsoft Windows Improper Privilege Management (CVE-2026-21533), covering the data sources and telemetry it touches: Microsoft Sentinel, Microsoft Defender for Endpoint, Windows Security Event Log. The queries below are rated high severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Privilege Escalation Persistence
Microsoft Sentinel / Defender
kusto 
let suspiciousPrivilegeEscalation = SecurityEvent
| where TimeGenerated > ago(24h)
| where EventID in (4672, 4673, 4674, 4688)
| where SubjectUserName !endswith '$'
| where SubjectUserName != 'SYSTEM'
| extend PrivilegesRequested = tostring(parse_json(EventData).PrivilegeList)
| where PrivilegesRequested has_any ('SeDebugPrivilege', 'SeTcbPrivilege', 'SeLoadDriverPrivilege', 'SeAssignPrimaryTokenPrivilege', 'SeTakeOwnershipPrivilege');
let newHighPrivProcess = DeviceProcessEvents
| where TimeGenerated > ago(24h)
| where InitiatingProcessAccountName !in ('SYSTEM', 'LOCAL SERVICE', 'NETWORK SERVICE')
| where InitiatingProcessIntegrityLevel in ('Low', 'Medium')
| where ProcessIntegrityLevel == 'High' or ProcessIntegrityLevel == 'System'
| project TimeGenerated, DeviceName, AccountName = InitiatingProcessAccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessIntegrityLevel, ProcessIntegrityLevel;
suspiciousPrivilegeEscalation
| join kind=inner (newHighPrivProcess) on $left.Computer == $right.DeviceName
| project TimeGenerated, Computer, SubjectUserName, PrivilegesRequested, FileName, ProcessCommandLine, InitiatingProcessIntegrityLevel, ProcessIntegrityLevel
| order by TimeGenerated desc

Correlates Windows Security Event privilege use events (4672/4673/4674) with process integrity level elevation in Defender for Endpoint, flagging non-system accounts that acquire sensitive privileges and spawn higher-integrity processes.

high severity medium confidence

Data Sources

Microsoft Sentinel Microsoft Defender for Endpoint Windows Security Event Log

Required Tables

SecurityEvent DeviceProcessEvents

False Positives

  • Legitimate software installers or update agents running as standard users that temporarily elevate privileges
  • IT administrators using tools like PsExec or RunAs for authorized administrative tasks
  • Privileged Access Workstation (PAW) activity where high-integrity processes are expected from interactive admin sessions
  • Endpoint security products performing scheduled scans that enumerate privileges

Sigma rule & cross-platform mapping

The detection logic for Microsoft Windows Improper Privilege Management (CVE-2026-21533) (CVE-2026-21533) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for CVE-2026-21533 Sigma rules on detection.fyi

Platform-specific guides for CVE-2026-21533

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-06-19 Research depth: standard
References (2)

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Token Impersonation via SeDebugPrivilege

    Expected signal: Windows Security Event ID 4673 (SeDebugPrivilege requested) and 4688 (new process: powershell.exe) with Medium integrity initiating a SeDebugPrivilege request.

  2. Test 2Process Launch at High Integrity from Medium Integrity Parent

    Expected signal: Event ID 4688 showing cmd.exe launched at High integrity (MandatoryLabel S-1-16-12288) with schtasks.exe as the initiating process from a Medium-integrity user session.

  3. Test 3Sensitive Privilege Enumeration via Token Inspection

    Expected signal: Event ID 4688 for cmd.exe and powershell.exe, potential Event ID 4672 if running in an elevated session. Process command line arguments visible in EDR telemetry.

Response Playbook

Triage

  1. Identify the affected host and account: correlate the alerting username and hostname against your asset inventory to determine the asset criticality, owner, and patch status for CVE-2026-21533.
  2. Verify the process lineage: capture the full parent-child process tree from EDR telemetry to determine whether the high-integrity process was spawned by a known-good binary (e.g., msiexec, installer) or an anomalous executable.
  3. Check the patch status of the host: query your patch management system or use CrowdStrike/Defender data to confirm whether the applicable Microsoft security update for CVE-2026-21533 has been applied.
  4. Review user activity context: examine authentication logs (Event ID 4624, 4625) for the 60 minutes preceding the alert to determine whether the session was interactive, remote, or spawned by a scheduled task.
  5. Assess lateral movement indicators: search for outbound network connections, SMB authentication attempts, or token impersonation events (Event ID 4648) originating from the affected host within the same timeframe.

Containment

  1. Isolate the affected endpoint using your EDR platform (CrowdStrike Network Containment or Defender for Endpoint Isolate Device) to prevent lateral movement while investigation proceeds.
  2. Disable the affected user account in Active Directory if exploitation is confirmed, and revoke any active Kerberos tickets (klist purge or nltest /SC_RESET) to invalidate stolen or manipulated credentials.
  3. Apply the Microsoft security patch for CVE-2026-21533 to the isolated host and all unpatched Windows systems identified in your environment using your patch deployment tooling.

Evidence Collection

  1. Collect a full memory image from the affected host using a forensic tool (e.g., WinPmem, Magnet RAM Capture) prior to remediation to preserve volatile artifacts including process tokens and injected code.
  2. Export Windows Security Event Logs (Security, System, Application) and EDR process telemetry covering at least 24 hours prior to the alert for offline analysis and preservation in your case management system.

Escalation Criteria

  • ! Escalate to Incident Response if the compromised account has Domain Admin, Schema Admin, or Enterprise Admin privileges, or if evidence of credential dumping (e.g., LSASS access, SAM hive reads) is detected on the host.
  • ! Escalate immediately if the exploitation appears to be part of a coordinated campaign: multiple hosts showing the same privilege escalation pattern within a short window, or if threat intelligence matches a known APT TTP.

Investigation Guide

Forensic Artifacts

  • > Windows Security Event Log entries with EventID 4672 (Special Logon), 4673 (Sensitive Privilege Use), and 4674 showing sensitive privilege assignment to non-system accounts.
  • > Process memory artifacts: token duplication or impersonation handles visible in a memory image via tools like Volatility (use the `handles` or `privs` plugins to enumerate token privileges per process).
  • > Prefetch files or Shimcache entries for unexpected executables launched at high integrity from user-writable directories (e.g., %TEMP%, %APPDATA%) around the time of exploitation.

Tuning Guidance

Start by suppressing alerts for known software deployment accounts (SCCM, Intune service accounts) and IT admin accounts using privileged access workstations — these generate high volumes of legitimate privilege events. Create allowlists for specific parent-child process pairs (e.g., explorer.exe → msiexec.exe at High integrity) and time-box exclusions to business hours for known maintenance windows. Increase confidence thresholds by requiring both the privilege event AND the integrity-level escalation within a short time window (2-5 minutes) for the same user and host. After patching, validate that the alert volume drops significantly; residual alerts after patching should be treated as higher-confidence indicators of unpatched systems or novel exploitation.

Hunting Queries

Threat hunt for processes launched at high or system integrity from user-writable parent process paths, excluding known-good elevation binaries. Covers a 7-day retrospective window to identify historical exploitation attempts that may have evaded real-time alerting.

Hunting — KQL
kql 
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessIntegrityLevel in ('Low', 'Medium')
| where ProcessIntegrityLevel in ('High', 'System')
| where not (FileName in~ ('consent.exe', 'msiexec.exe', 'setup.exe', 'install.exe'))
| where not (InitiatingProcessFileName in~ ('explorer.exe', 'svchost.exe'))
| summarize count() by FileName, InitiatingProcessFileName, InitiatingProcessCommandLine, DeviceName, AccountName
| where count_ > 1
| order by count_ desc
Hunting — SPL
spl 
index=wineventlog sourcetype=WinEventLog:Security EventCode=4688
| where MandatoryLabel IN ("S-1-16-12288", "S-1-16-16384")
| where NOT match(SubjectUserName, "\$$")
| where SubjectUserName NOT IN ("SYSTEM", "LOCAL SERVICE", "NETWORK SERVICE")
| where NOT NewProcessName IN ("C:\\Windows\\System32\\consent.exe", "C:\\Windows\\System32\\msiexec.exe")
| eval ParentDir=lower(substr(ParentProcessName, 1, len(ParentProcessName) - len(mvindex(split(ParentProcessName, "\\"), -1))))
| where match(ParentDir, "users|temp|appdata|public")
| stats count by SubjectUserName, ComputerName, ParentProcessName, NewProcessName, CommandLine
| sort - count

Atomic Red Team Tests

Test 1 Token Impersonation via SeDebugPrivilege
windows

Simulates privilege escalation by enabling SeDebugPrivilege on the current process and opening a SYSTEM process handle, mimicking the token manipulation behavior associated with CWE-269 exploitation.

Command

powershell 
powershell -NoProfile -ExecutionPolicy Bypass -Command "$code = @'
[DllImport(\"advapi32.dll\", SetLastError=true)] public static extern bool OpenProcessToken(IntPtr h, uint acc, out IntPtr tok);
[DllImport(\"advapi32.dll\", SetLastError=true)] public static extern bool LookupPrivilegeValue(string sys, string name, out long luid);
[DllImport(\"advapi32.dll\", SetLastError=true)] public static extern bool AdjustTokenPrivileges(IntPtr tok, bool dis, ref TOKEN_PRIVILEGES tp, uint bufLen, IntPtr prev, IntPtr retLen);
[StructLayout(LayoutKind.Sequential)] public struct TOKEN_PRIVILEGES { public uint PrivilegeCount; public long Luid; public uint Attributes; }
'@; Add-Type -MemberDefinition $code -Name 'TokenPriv' -Namespace 'Win32'; Write-Host '[CVE-2026-21533-SIM] SeDebugPrivilege request simulated'"

Cleanup

powershell 
Close PowerShell session; no persistent changes made.

Expected Telemetry

Windows Security Event ID 4673 (SeDebugPrivilege requested) and 4688 (new process: powershell.exe) with Medium integrity initiating a SeDebugPrivilege request.

Expected Detection

Alert triggered on sensitive privilege use (SeDebugPrivilege) by a non-system interactive user account.

Test 2 Process Launch at High Integrity from Medium Integrity Parent
windows

Simulates the integrity-level escalation pattern by using a scheduled task (which runs at High integrity) triggered from a Medium-integrity user session, representing the observable post-exploitation process behavior.

Command

powershell 
cmd.exe /c schtasks /Create /TN "CVE2026Sim" /TR "cmd.exe /c whoami > C:\Windows\Temp\privesc_test.txt" /SC ONCE /ST 00:00 /RL HIGHEST /F && schtasks /Run /TN "CVE2026Sim"

Cleanup

powershell 
schtasks /Delete /TN "CVE2026Sim" /F && del C:\Windows\Temp\privesc_test.txt

Expected Telemetry

Event ID 4688 showing cmd.exe launched at High integrity (MandatoryLabel S-1-16-12288) with schtasks.exe as the initiating process from a Medium-integrity user session.

Expected Detection

Alert on integrity-level escalation: Medium-integrity parent (schtasks.exe from user session) spawning High-integrity child process.

Test 3 Sensitive Privilege Enumeration via Token Inspection
windows

Uses built-in Windows tooling to enumerate current token privileges, which an attacker would perform post-exploitation to verify their elevated privilege set — generates the telemetry pattern expected from CVE-2026-21533 exploitation validation steps.

Command

powershell 
cmd.exe /c whoami /priv && powershell -Command "[System.Security.Principal.WindowsIdentity]::GetCurrent().Groups | ForEach-Object { $_.Translate([System.Security.Principal.NTAccount]).Value }"

Cleanup

powershell 
No cleanup required; read-only commands.

Expected Telemetry

Event ID 4688 for cmd.exe and powershell.exe, potential Event ID 4672 if running in an elevated session. Process command line arguments visible in EDR telemetry.

Expected Detection

Process command line hunting rule detecting 'whoami /priv' or WindowsIdentity token enumeration in combination with prior privilege escalation events on the same host.

Related Detections

Tactic Hubs

TA0004Privilege EscalationTA0003Persistence

Related Techniques

T1068Exploitation for Privilege EscalationT1134Access Token ManipulationT1548.002Bypass User Account Control

Same Tactic: Privilege Escalation

Popular Detections