CVE-2026-66804: Dark Elevator Fix Left Windows Exposed

Microsoft’s July fix for Dark Elevator, the Windows privilege-escalation chain Calif disclosed as CVE-2026-50343, closed only half the bug. It shut the registry weakness in InstallService but left the dangling CrossDevice COM registration the exploit relied on, and Google Project Zero’s James Forshaw — with 14 other researchers — turned that leftover into a fresh route to SYSTEM, now tracked as CVE-2026-66804.

CVE-2026-66804, a Windows Cross Device Service elevation-of-privilege flaw, carries a CVSS score of 7.8 and stems from improper access control (CWE-284). A standard local user can load an attacker-controlled DLL into a SYSTEM process and execute code as NT AUTHORITY\SYSTEM — the same outcome as the bug it descends from.

How the Bypass Works

The CrossDevice class {E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496} registers its in-process DLL at %PROGRAMDATA%\CrossDevice\CrossDevice.Streaming.Source.dll, a path that does not exist and that any user can create. Dark Elevator reached that DLL through InstallService; once Microsoft locked that door, Forshaw walked through another. A fake IMarshal object returns the dangling CLSID, so when it is marshaled to a SYSTEM COM service that still permits custom marshaling, Forshaw used the Shell Create Object Handler, launched through a scheduled task any user can start — the runtime unmarshals it, loads the planted DLL, and the attacker runs as SYSTEM.

Which Windows Versions Are Affected

Microsoft lists Windows 10 22H2 and Windows 11 24H2, 25H2, and 26H1 as affected. The fix arrives in these builds:

Has Microsoft Patched It?

Microsoft published CVE-2026-66804 on August 11, 2026, and shipped the patch in its August Patch Tuesday, rating it Important. It is not in CISA’s Known Exploited Vulnerabilities catalog, and no in-the-wild exploitation has been confirmed, though public technical write-ups now describe the technique in full. Installing the builds above removes the dangling registration and closes the path for good.