CVE-2026-48581

EUVD-2026-43794 · Published Jul 14, 2026

Insufficient granularity of access control in Microsoft Surface allows an authorized attacker to elevate privileges locally.

Technologies

Microsoft Surface Go 3 1926 FirmwareMicrosoft Surface Hub 2S 85 FirmwareMicrosoft Surface Hub 2SMicrosoft Surface Laptop 4 1959 FirmwareMicrosoft Surface Laptop 4 1952Microsoft Surface Pro 7\+ With Lte Advanced 1961Microsoft Surface Laptop 4 1950 FirmwareMicrosoft Surface Pro 8 For Business 1983Microsoft Surface Go 2 1926Microsoft Surface Pro 8 For Business 1983 FirmwareMicrosoft Surface Laptop 4 1952 FirmwareMicrosoft Surface Hub 3 50Microsoft Surface Laptop Go 1943Microsoft Surface Hub 3 50 FirmwareMicrosoft Surface Laptop 4 1979Microsoft Surface Laptop Go 2 2013Microsoft Surface Go 3 1901 FirmwareMicrosoft Surface HubMicrosoft Surface Go 3 1926Microsoft Surface Pro 8 1983Microsoft Surface Go 2 1901 FirmwareMicrosoft Surface Laptop 4 1978Microsoft Surface Laptop Go 1943 FirmwareMicrosoft Surface Laptop Go 3 2013 FirmwareMicrosoft Surface Go 3 2022Microsoft Surface Go 3 1901Microsoft Surface Laptop 4 1978 FirmwareMicrosoft Surface Pro 7\+ 1960Microsoft Surface Hub 2S FirmwareMicrosoft Surface Laptop Go 3 2013Microsoft Surface Hub FirmwareMicrosoft Surface Laptop Go 2 2013 FirmwareMicrosoft Surface Go 2 1927 FirmwareMicrosoft Surface Go 2 1901Microsoft Surface Laptop 4 1950Microsoft Surface Laptop 4 1951Microsoft Surface Hub 3 85 FirmwareMicrosoft Surface Pro 8 For Business With Lte Advanced 1982Microsoft Surface Pro 8 For Business With Lte Advanced 1982 FirmwareMicrosoft Surface Laptop 4 1953Microsoft Surface Laptop 4 1958Microsoft Surface Go 3 2022 FirmwareMicrosoft Surface Go 2 1926 FirmwareMicrosoft Surface Laptop 4 1958 FirmwareMicrosoft Surface Go 2 1927Microsoft Surface Pro 8 1983 FirmwareMicrosoft Surface Pro 7\+ With Lte Advanced 1961 FirmwareMicrosoft Surface Laptop 4 1953 FirmwareMicrosoft Surface Hub 3 85Microsoft Surface Laptop 4 1979 FirmwareMicrosoft Surface Pro 7\+ 1960 FirmwareMicrosoft Surface Laptop 4 1959Microsoft Surface Laptop 4 1951 FirmwareMicrosoft Surface Hub 2S 85

Weaknesses

CWE-1220

CVSS scores

v3.17.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Execution Privilege Escalation Stealth

T1068Exploitation for Privilege Escalation T1574.010Services File Permissions Weakness

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48581

Potentially impacted assets

See if this affects your attack surface