📄 الوصف (الإنجليزية)
External control of file name or path in Windows Kernel allows an authorized attacker to elevate privileges locally.
🤖 ملخص AI
CVE-2026-24287 is a Windows Kernel privilege escalation vulnerability affecting multiple Windows 10 and Windows 11 versions through improper file path control (CWE-73). With a CVSS score of 7.8, this vulnerability requires local authenticated access but enables attackers to elevate privileges to SYSTEM level. Immediate patching is critical for Saudi organizations as this affects widely deployed Windows infrastructure across government, banking, and enterprise sectors.
📄 الوصف (العربية)
🤖 التحليل الذكي آخر تحليل: Apr 29, 2026 02:48
🇸🇦 التأثير على المملكة العربية السعودية
This vulnerability poses significant risk to Saudi banking sector (SAMA-regulated institutions), government agencies (NCA oversight), healthcare facilities, and energy sector organizations. Windows 10/11 are ubiquitous in Saudi enterprises, making this a widespread exposure. Threat actors with initial local access (via phishing, supply chain, or insider threats) can escalate to SYSTEM privileges, potentially compromising critical systems managing financial transactions, classified government data, patient records, and SCADA systems. STC and other telecom operators managing network infrastructure are also at elevated risk.
🏢 القطاعات السعودية المتأثرة
Banking and Financial Services
Government and Public Administration
Healthcare and Medical Facilities
Energy and Utilities
Telecommunications
Defense and Security
Education
Transportation
🎯 تقنيات MITRE ATT&CK
T1548.004 - Abuse Elevation Control Mechanism: Elevated Execution with Prompt
T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
T1036.005 - Masquerading: Match Legitimate Name or Location
T1574.008 - Hijack Execution Flow: DLL Search Order Hijacking
T1574.012 - Hijack Execution Flow: COR_PROFILER
⚖️ درجة المخاطر السعودية (AI)
8.2
/ 10.0
🔧 Remediation Steps (English)
IMMEDIATE ACTIONS:
1. Inventory all Windows 10 (versions 1809, 21H2, 22H2) and Windows 11 (23H2) systems across your organization
2. Prioritize patching for systems in critical infrastructure, banking, and government networks
3. Apply Microsoft security updates immediately upon availability
4. Implement application whitelisting to restrict unauthorized executable execution
PATCHING GUIDANCE:
1. Deploy Windows Update patches through WSUS or Microsoft Intune for enterprise environments
2. Test patches in non-production environments first
3. Schedule patching during maintenance windows to minimize business disruption
4. Verify patch installation using Get-HotFix PowerShell command
COMPENSATING CONTROLS (if immediate patching delayed):
1. Restrict local administrative privileges using Group Policy (remove users from local Administrators group)
2. Enable Windows Defender Application Guard for isolated execution environments
3. Implement privileged access management (PAM) solutions to monitor and control privilege escalation attempts
4. Deploy endpoint detection and response (EDR) solutions to detect suspicious kernel-level activity
5. Monitor file system access patterns for unauthorized path manipulation
DETECTION RULES:
1. Monitor Event ID 4688 (Process Creation) for suspicious kernel-related processes
2. Alert on unusual file path creation in system directories (C:\Windows\System32, C:\Windows\Temp)
3. Track privilege escalation events (Event ID 4672 - Special Privileges Assigned)
4. Monitor for CWE-73 indicators: symlink creation, junction point manipulation, DLL hijacking attempts
5. Implement YARA rules to detect exploitation patterns in memory dumps
🔧 خطوات المعالجة (العربية)
الإجراءات الفورية:
1. حصر جميع أنظمة Windows 10 (الإصدارات 1809، 21H2، 22H2) و Windows 11 (23H2) في المنظمة
2. إعطاء الأولوية لتصحيح الأنظمة في البنية التحتية الحرجة والشبكات الحكومية والمصرفية
3. تطبيق تحديثات أمان Microsoft فور توفرها
4. تنفيذ قائمة بيضاء للتطبيقات لتقييد تنفيذ الملفات غير المصرح بها
إرشادات التصحيح:
1. نشر تحديثات Windows من خلال WSUS أو Microsoft Intune للبيئات الموزعة
2. اختبار التحديثات في بيئات غير الإنتاج أولاً
3. جدولة التصحيح خلال نوافذ الصيانة لتقليل تأثر العمليات
4. التحقق من تثبيت التحديثات باستخدام أوامر PowerShell
الضوابط البديلة (إذا تأخر التصحيح الفوري):
1. تقييد امتيازات المسؤول المحلي باستخدام Group Policy
2. تفعيل Windows Defender Application Guard للتنفيذ المعزول
3. تنفيذ حلول إدارة الوصول المميز (PAM) لمراقبة محاولات رفع الامتيازات
4. نشر حلول الكشف والاستجابة على نقاط النهاية (EDR)
5. مراقبة أنماط الوصول إلى نظام الملفات للكشف عن معالجة المسارات غير المصرح بها
📋 خريطة الامتثال التنظيمي
🟢 NCA ECC 2024
ECC 2024 A.5.1.1 - Access Control Policies (privilege escalation prevention)
ECC 2024 A.12.2.1 - Change Management (patch management procedures)
ECC 2024 A.12.6.1 - Management of Technical Vulnerabilities (vulnerability assessment and remediation)
🔵 SAMA CSF
SAMA CSF ID.AM-2 - Asset Management (inventory Windows systems)
SAMA CSF PR.PT-2 - Protective Technology (patch management)
SAMA CSF DE.CM-4 - Malware Detection (EDR deployment for exploitation detection)
🟡 ISO 27001:2022
ISO 27001:2022 A.12.3.1 - Configuration Management (secure system configuration)
ISO 27001:2022 A.12.6.1 - Management of Technical Vulnerabilities (patch management)
ISO 27001:2022 A.5.23 - Information Security for Supplier Relationships (vendor patch delivery)
🟣 PCI DSS v4.0.1
PCI DSS 6.2 - Security Patches (timely application of vendor patches)
PCI DSS 11.2 - Vulnerability Scanning (regular scanning for unpatched systems)
📦 المنتجات المتأثرة 20 منتج
microsoft:windows_10_1809
microsoft:windows_10_1809
microsoft:windows_10_21h2
microsoft:windows_10_21h2
microsoft:windows_10_21h2
microsoft:windows_10_22h2
microsoft:windows_10_22h2
microsoft:windows_10_22h2
microsoft:windows_11_23h2
microsoft:windows_11_23h2
microsoft:windows_11_24h2
microsoft:windows_11_24h2
microsoft:windows_11_25h2
microsoft:windows_11_25h2
microsoft:windows_11_26h1
microsoft:windows_11_26h1
microsoft:windows_server_2019
microsoft:windows_server_2022
microsoft:windows_server_2022_23h2
microsoft:windows_server_2025