CVEvulnerability

CVE-2026-48581

7.8 HIGH Published 2026-07-14 Modified 2026-07-24 Official page ↗
Status
Analyzed
Published
2026-07-14
Last modified
2026-07-24
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-1220

Description

Insufficient granularity of access control in Microsoft Surface allows an authorized attacker to elevate privileges locally.

Affected configurations

• microsoft surface go 2 1901 firmware • microsoft surface go 2 1926 firmware • microsoft surface go 2 1927 firmware • microsoft surface go 3 1901 firmware • microsoft surface go 3 1926 firmware • microsoft surface go 3 2022 firmware • microsoft surface hub firmware • microsoft surface hub 2s firmware • microsoft surface hub 2s 85 firmware • microsoft surface hub 3 50 firmware • microsoft surface hub 3 85 firmware • microsoft surface laptop go 1943 firmware • microsoft surface laptop go 2 2013 firmware • microsoft surface laptop go 3 2013 firmware • microsoft surface pro 7\+ 1960 firmware • microsoft surface pro 7\+ with lte advanced 1961 firmware • microsoft surface pro 8 1983 firmware • microsoft surface pro 8 for business 1983 firmware • microsoft surface pro 8 for business with lte advanced 1982 firmware • microsoft surface laptop 4 1979 firmware • microsoft surface laptop 4 1950 firmware • microsoft surface laptop 4 1951 firmware • microsoft surface laptop 4 1952 firmware • microsoft surface laptop 4 1953 firmware • microsoft surface laptop 4 1958 firmware • microsoft surface laptop 4 1959 firmware • microsoft surface laptop 4 1978 firmware

Related

Weakness · CWE (1)

  • CWE-1220 Insufficient Granularity of Access Control weakness

References