CVE-2026-48581

HIGH

MEDIUM Priority: 0.02 BB Relevance: 41/100

Published: 2026-07-14 Modified: 2026-10-28 First seen: 2026-10-29 Status: active

Low Complexity No Interaction Conf. Impact Integ. Impact

AV: Local

AC: Low

PR: Low

UI: None

S: Unchanged

C: High

I: High

A: High

Insufficient granularity of access control in Microsoft Surface allows an authorized attacker to elevate privileges locally.

Vendor	Product	Version
Microsoft	Microsoft Surface Go	-
Microsoft	Microsoft Surface Go	-
Microsoft	Microsoft Surface Hub	-
Microsoft	Microsoft Surface Hub	-
Microsoft	Microsoft Surface Laptop Go	-
Microsoft	Microsoft Surface Laptop Go	-
Microsoft	Microsoft Surface Laptop Go 3	-
Microsoft	Microsoft Surface Laptop Go 3	-
Microsoft	Microsoft Surface Pro	-
Microsoft	Microsoft Surface Pro	-
Microsoft	Microsoft Surface Pro 8	-
Microsoft	Microsoft Surface Pro 8	-
Microsoft	Surface Laptop 4 with AMD Processor	-
Microsoft	Surface Laptop 4 with AMD Processor	-
Microsoft	Surface Laptop 4 with Intel Processor	-
Microsoft	Surface Laptop 4 with Intel Processor	-
Microsoft	Surface Windows Dev Kit	-
Microsoft	Surface Windows Dev Kit	-
microsoft	surface_go_2_1901_firmware	-
microsoft	surface_go_2_1926_firmware	-
microsoft	surface_go_2_1927_firmware	-
microsoft	surface_go_3_1901_firmware	-
microsoft	surface_go_3_1926_firmware	-
microsoft	surface_go_3_2022_firmware	-
microsoft	surface_hub_2s_85_firmware	-
microsoft	surface_hub_2s_firmware	-
microsoft	surface_hub_3_50_firmware	-
microsoft	surface_hub_3_85_firmware	-
microsoft	surface_hub_firmware	-
microsoft	surface_laptop_4_1950_firmware	-

Showing 30 of 45 entries

vendor-advisory patch

41 / 100

✓ Low complexity
✓ No user interaction

7.8 / 10.0 v3.1

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

0.30%

Raw Score 0.002980

Percentile 22.5%

Date 2026-10-29

2026-10-29

0.00298

2026-10-28

0.00298

mitre ref →