Vulnpedia
← All CVEs

CVE-2026-66804

HIGH 7.8 ALL-YEARS

Published 2026-08-11 · Last modified 2026-10-21 · microsoft · NVD: Analyzed

Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally.

ELEVATED IMPACT

Severe if exploited (CVSS 7.8), but no confirmed exploitation. Patch on a normal cadence.

Exploitation likelihood

0.3%chance of exploitation in 30 days · 22nd percentile

○ In CISA KEV○ Catalogued PoC◆ SSVC: exploitation none, automatable no

Impact if exploited

7.8CVSS 3.1 · HIGH · CNA

  • ConfidentialityHigh
  • IntegrityHigh
  • AvailabilityHigh

What an attacker needs

  • ⚠Access: Requires local access to the host
  • ⚠Privileges: Requires a low-privilege account
  • ✓User interaction: No user interaction needed
  • ✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Affected

Vendors Microsoft

Products Windows 10 Version 22h2 Windows 11 Version 24h2 Windows 11 Version 25h2 Windows 11 Version 26h1 Windows 10 22h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1

Weakness (CWE)

  • CWE-284: : Improper Access Control

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

References and research data (JSON)

Vendor product assessments

Showing 32 of 1800 vendor product statements; 1768 omitted. Read the full vendor advisory.

  • registry.redhat.io/rhacm2/console-rhel9@sha256:1f0c691b68fd10948199249a142dfcd7fb438d856a1a4f365d490c452be35e83_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 · fixed

    Vendor assessment for this product only.

    pkg:oci/console-rhel9@sha256%3A1f0c691b68fd10948199249a142dfcd7fb438d856a1a4f365d490c452be35e83?arch=s390x&repository_url=registry.redhat.io/rhacm2/console-rhel9&tag=1787687062

    • vendor fix: Before you apply this update, make sure all previously released errata that are relevant to your system are applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    Red Hat · CVE-2026-66804 · Updated 2026-10-16T17:26:04+00:00
  • registry.redhat.io/rhacm2/console-rhel9@sha256:a7540d4c501e1d1215ebff1f0b572f74e3b9a55bffb1ebfccb9546307d67116b_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 · fixed

    Vendor assessment for this product only.

    pkg:oci/console-rhel9@sha256%3Aa7540d4c501e1d1215ebff1f0b572f74e3b9a55bffb1ebfccb9546307d67116b?arch=arm64&repository_url=registry.redhat.io/rhacm2/console-rhel9&tag=1787687062

    • vendor fix: Before you apply this update, make sure all previously released errata that are relevant to your system are applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    Red Hat · CVE-2026-66804 · Updated 2026-10-16T17:26:04+00:00
  • registry.redhat.io/rhacm2/console-rhel9@sha256:635b9d6b3667429f78426d779053b7611b1a40ab33c6849b57baa3e310bad0dc_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13 · fixed

    Vendor assessment for this product only.

    pkg:oci/console-rhel9@sha256%3A635b9d6b3667429f78426d779053b7611b1a40ab33c6849b57baa3e310bad0dc?arch=ppc64le&repository_url=registry.redhat.io/rhacm2/console-rhel9&tag=1787339249

    • vendor fix: Before you apply this update, make sure all previously released errata that are relevant to your system are applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    Red Hat · CVE-2026-66804 · Updated 2026-10-16T17:26:04+00:00
  • registry.redhat.io/rhacm2/console-rhel9@sha256:852a0eb10674a84b3110c4f8a589495a2f78288a415230d6aa07c52810cc1950_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14 · fixed

    Vendor assessment for this product only.

    pkg:oci/console-rhel9@sha256%3A852a0eb10674a84b3110c4f8a589495a2f78288a415230d6aa07c52810cc1950?arch=s390x&repository_url=registry.redhat.io/rhacm2/console-rhel9&tag=1787339248

    • vendor fix: Before you apply this update, make sure all previously released errata that are relevant to your system are applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    Red Hat · CVE-2026-66804 · Updated 2026-10-16T17:26:04+00:00
  • registry.redhat.io/rhacm2/console-rhel9@sha256:70e82dc33ab21468bc7d6a1f8a460bcf98ad609e844b0d55ba5718c9351dbda1_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15 · fixed

    Vendor assessment for this product only.

    pkg:oci/console-rhel9@sha256%3A70e82dc33ab21468bc7d6a1f8a460bcf98ad609e844b0d55ba5718c9351dbda1?arch=s390x&repository_url=registry.redhat.io/rhacm2/console-rhel9&tag=1787341780

    • vendor fix: Before you apply this update, make sure all previously released errata that are relevant to your system are applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    Red Hat · CVE-2026-66804 · Updated 2026-10-16T17:26:04+00:00
  • registry.redhat.io/rhacm2/console-rhel9@sha256:75910c4198336f86a0b345b116437dd608a35a975a0c92c684a77945b464a66d_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16 · fixed

    Vendor assessment for this product only.

    pkg:oci/console-rhel9@sha256%3A75910c4198336f86a0b345b116437dd608a35a975a0c92c684a77945b464a66d?arch=ppc64le&repository_url=registry.redhat.io/rhacm2/console-rhel9&tag=1786908361

    • vendor fix: Before you apply this update, make sure all previously released errata that are relevant to your system are applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    Red Hat · CVE-2026-66804 · Updated 2026-10-16T17:26:04+00:00
  • registry.redhat.io/rhacm2/console-rhel9@sha256:ff46410d53fb779b172325276dd3223491fa7824324a2847d7f44e6fc39a3feb_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16 · fixed

    Vendor assessment for this product only.

    pkg:oci/console-rhel9@sha256%3Aff46410d53fb779b172325276dd3223491fa7824324a2847d7f44e6fc39a3feb?arch=s390x&repository_url=registry.redhat.io/rhacm2/console-rhel9&tag=1786908361

    • vendor fix: Before you apply this update, make sure all previously released errata that are relevant to your system are applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    Red Hat · CVE-2026-66804 · Updated 2026-10-16T17:26:04+00:00
  • registry.redhat.io/rhacm2/console-rhel9@sha256:5b0496138b3fd32d7032f33ea96d58f93ca0e56e817914b67e13c6fceb10a0dd_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.17 · fixed

    Vendor assessment for this product only.

    pkg:oci/console-rhel9@sha256%3A5b0496138b3fd32d7032f33ea96d58f93ca0e56e817914b67e13c6fceb10a0dd?arch=amd64&repository_url=registry.redhat.io/rhacm2/console-rhel9&tag=1787335105

    • vendor fix: Before you apply this update, make sure all previously released errata that are relevant to your system are applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    Red Hat · CVE-2026-66804 · Updated 2026-10-16T17:26:04+00:00
  • registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:4e802bcd67c6d552fd4303103c098f8cd63b118d5aaf5fe518132bf7d16c210e_ppc64le as a component of multicluster engine for Kubernetes 2.10 · fixed

    Vendor assessment for this product only.

    pkg:oci/console-mce-rhel9@sha256%3A4e802bcd67c6d552fd4303103c098f8cd63b118d5aaf5fe518132bf7d16c210e?arch=ppc64le&repository_url=registry.redhat.io/multicluster-engine/console-mce-rhel9&tag=1787079364

    • vendor fix: For multicluster engine for Kubernetes, see the following documentation for details on how to install the images: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/clusters/cluster_mce_overview#mce-install-intro Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    Red Hat · CVE-2026-66804 · Updated 2026-10-16T17:26:04+00:00
  • registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:31c72f35b5d170209dbf1d0801f12b0671283765157ec690774fc50aefde944e_ppc64le as a component of multicluster engine for Kubernetes 2.11 · fixed

    Vendor assessment for this product only.

    pkg:oci/console-mce-rhel9@sha256%3A31c72f35b5d170209dbf1d0801f12b0671283765157ec690774fc50aefde944e?arch=ppc64le&repository_url=registry.redhat.io/multicluster-engine/console-mce-rhel9&tag=1786911977

    • vendor fix: For multicluster engine for Kubernetes, see the following documentation for details on how to install the images: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.16/html/clusters/cluster_mce_overview#mce-install-intro Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    Red Hat · CVE-2026-66804 · Updated 2026-10-16T17:26:04+00:00
  • registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:b25cd815f89acc196fa6060bcfb155a19b1ae49a5e2911ac23d6548a499bd34c_arm64 as a component of multicluster engine for Kubernetes 2.11 · fixed

    Vendor assessment for this product only.

    pkg:oci/console-mce-rhel9@sha256%3Ab25cd815f89acc196fa6060bcfb155a19b1ae49a5e2911ac23d6548a499bd34c?arch=arm64&repository_url=registry.redhat.io/multicluster-engine/console-mce-rhel9&tag=1786911977

    • vendor fix: For multicluster engine for Kubernetes, see the following documentation for details on how to install the images: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.16/html/clusters/cluster_mce_overview#mce-install-intro Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    Red Hat · CVE-2026-66804 · Updated 2026-10-16T17:26:04+00:00
  • registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:8d3256f9df83b82e8bdef2a8d0c706695d5c9674e263755cb1db42158140c5a5_amd64 as a component of multicluster engine for Kubernetes 2.17 · fixed

    Vendor assessment for this product only.

    pkg:oci/console-mce-rhel9@sha256%3A8d3256f9df83b82e8bdef2a8d0c706695d5c9674e263755cb1db42158140c5a5?arch=amd64&repository_url=registry.redhat.io/multicluster-engine/console-mce-rhel9&tag=1786668856

    • vendor fix: For multicluster engine for Kubernetes, see the following documentation for details on how to install the images: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.17/html/clusters/cluster_mce_overview#mce-install-intro Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    Red Hat · CVE-2026-66804 · Updated 2026-10-16T17:26:04+00:00
  • registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:d9462b7e8e1ea92347f210640de7676e8ab55d53d4fbc1319de4f2c24488fe41_s390x as a component of multicluster engine for Kubernetes 2.6 · fixed

    Vendor assessment for this product only.

    pkg:oci/console-mce-rhel9@sha256%3Ad9462b7e8e1ea92347f210640de7676e8ab55d53d4fbc1319de4f2c24488fe41?arch=s390x&repository_url=registry.redhat.io/multicluster-engine/console-mce-rhel9&tag=1787264250

    • vendor fix: For multicluster engine for Kubernetes, see the following documentation for details on how to install the images: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.11/html/clusters/cluster_mce_overview#mce-install-intro Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    Red Hat · CVE-2026-66804 · Updated 2026-10-16T17:26:04+00:00
  • registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:55ecb01a4602e320c1e5f6212544f2159cfb4ee8393930f36ce4117fee5f5c2f_amd64 as a component of multicluster engine for Kubernetes 2.8 · fixed

    Vendor assessment for this product only.

    pkg:oci/console-mce-rhel9@sha256%3A55ecb01a4602e320c1e5f6212544f2159cfb4ee8393930f36ce4117fee5f5c2f?arch=amd64&repository_url=registry.redhat.io/multicluster-engine/console-mce-rhel9&tag=1787259048

    • vendor fix: For multicluster engine for Kubernetes, see the following documentation for details on how to install the images: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.13/html/clusters/cluster_mce_overview#mce-install-intro Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    Red Hat · CVE-2026-66804 · Updated 2026-10-16T17:26:04+00:00
  • registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:031b03a535eb71c43d15621e56127672a34ee4bc22e7032e1410956ebae59e3a_ppc64le as a component of multicluster engine for Kubernetes 2.9 · fixed

    Vendor assessment for this product only.

    pkg:oci/console-mce-rhel9@sha256%3A031b03a535eb71c43d15621e56127672a34ee4bc22e7032e1410956ebae59e3a?arch=ppc64le&repository_url=registry.redhat.io/multicluster-engine/console-mce-rhel9&tag=1787079359

    • vendor fix: For multicluster engine for Kubernetes, see the following documentation for details on how to install the images: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.14/html/clusters/cluster_mce_overview#mce-install-intro Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    Red Hat · CVE-2026-66804 · Updated 2026-10-16T17:26:04+00:00
  • registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:afa61b8ffb34702fa11001efa74fe62cdbacf78c9a5865ddb28ca801b173093c_amd64 as a component of multicluster engine for Kubernetes 2.9 · fixed

    Vendor assessment for this product only.

    pkg:oci/console-mce-rhel9@sha256%3Aafa61b8ffb34702fa11001efa74fe62cdbacf78c9a5865ddb28ca801b173093c?arch=amd64&repository_url=registry.redhat.io/multicluster-engine/console-mce-rhel9&tag=1787079359

    • vendor fix: For multicluster engine for Kubernetes, see the following documentation for details on how to install the images: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.14/html/clusters/cluster_mce_overview#mce-install-intro Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    Red Hat · CVE-2026-66804 · Updated 2026-10-16T17:26:04+00:00
  • registry.redhat.io/rhacm2/acm-cluster-permission-rhel9@sha256:3713326a7c0dde1bdd3e812ef366a409f8edcc773653b26ca81807db9f86b2ac_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/acm-cluster-permission-rhel9@sha256%3A3713326a7c0dde1bdd3e812ef366a409f8edcc773653b26ca81807db9f86b2ac?arch=arm64&repository_url=registry.redhat.io/rhacm2/acm-cluster-permission-rhel9&tag=1787681473

    Red Hat · CVE-2026-66804 · Updated 2026-10-16T17:26:04+00:00
  • registry.redhat.io/rhacm2/multiclusterhub-rhel9@sha256:425a9c8f85d71f7f7414544905f830a634b2384fbad680c4fb2f63d1e292b20c_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/multiclusterhub-rhel9@sha256%3A425a9c8f85d71f7f7414544905f830a634b2384fbad680c4fb2f63d1e292b20c?arch=amd64&repository_url=registry.redhat.io/rhacm2/multiclusterhub-rhel9&tag=1787687637

    Red Hat · CVE-2026-66804 · Updated 2026-10-16T17:26:04+00:00
  • registry.redhat.io/rhacm2/governance-policy-propagator-rhel9@sha256:381972d2cfec6720678e0bda211e4d5b40f22a6655f7756ff8d0327a29b71d66_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/governance-policy-propagator-rhel9@sha256%3A381972d2cfec6720678e0bda211e4d5b40f22a6655f7756ff8d0327a29b71d66?arch=s390x&repository_url=registry.redhat.io/rhacm2/governance-policy-propagator-rhel9&tag=1787267721

    Red Hat · CVE-2026-66804 · Updated 2026-10-16T17:26:04+00:00
  • registry.redhat.io/rhacm2/acm-grafana-rhel9@sha256:2f097900e95f40192ccc10a495f16234d5d07bfb8702244d0471f00f35eb8e4f_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/acm-grafana-rhel9@sha256%3A2f097900e95f40192ccc10a495f16234d5d07bfb8702244d0471f00f35eb8e4f?arch=arm64&repository_url=registry.redhat.io/rhacm2/acm-grafana-rhel9&tag=1787645355

    Red Hat · CVE-2026-66804 · Updated 2026-10-16T17:26:04+00:00
  • registry.redhat.io/rhacm2/node-exporter-rhel9@sha256:b8a77063c342acc66fab47b5437fe9e3959ad9812ae8fd764d88ae3d85afdaa9_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/node-exporter-rhel9@sha256%3Ab8a77063c342acc66fab47b5437fe9e3959ad9812ae8fd764d88ae3d85afdaa9?arch=amd64&repository_url=registry.redhat.io/rhacm2/node-exporter-rhel9&tag=1787233241

    Red Hat · CVE-2026-66804 · Updated 2026-10-16T17:26:04+00:00
  • registry.redhat.io/rhacm2/insights-client-rhel9@sha256:3b44bbca3e5d4b9f4e7a71735b9da48d5c985a2478a04e1f7f42753a0b2c76f5_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/insights-client-rhel9@sha256%3A3b44bbca3e5d4b9f4e7a71735b9da48d5c985a2478a04e1f7f42753a0b2c76f5?arch=ppc64le&repository_url=registry.redhat.io/rhacm2/insights-client-rhel9&tag=1787238585

    Red Hat · CVE-2026-66804 · Updated 2026-10-16T17:26:04+00:00
  • registry.redhat.io/rhacm2/acm-grafana-rhel9@sha256:16ff5bd2ac80a8c717a78b0d94daa49714488c1a2db200a9792b75c12af91d9b_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/acm-grafana-rhel9@sha256%3A16ff5bd2ac80a8c717a78b0d94daa49714488c1a2db200a9792b75c12af91d9b?arch=s390x&repository_url=registry.redhat.io/rhacm2/acm-grafana-rhel9&tag=1786908968

    Red Hat · CVE-2026-66804 · Updated 2026-10-16T17:26:04+00:00
  • registry.redhat.io/rhacm2/multicluster-role-assignment-rhel9@sha256:30a8974cba82bb345a882185681b0e89c7542592e6f08cd8474a6ba3c8602743_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/multicluster-role-assignment-rhel9@sha256%3A30a8974cba82bb345a882185681b0e89c7542592e6f08cd8474a6ba3c8602743?arch=amd64&repository_url=registry.redhat.io/rhacm2/multicluster-role-assignment-rhel9&tag=1786908682

    Red Hat · CVE-2026-66804 · Updated 2026-10-16T17:26:04+00:00
  • registry.redhat.io/rhacm2/endpoint-monitoring-rhel9-operator@sha256:e2c917626e4a9bfd8a0bb1511a5d1f29fef3a4f870b3f9bfab6f622a928c556d_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.17 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/endpoint-monitoring-rhel9-operator@sha256%3Ae2c917626e4a9bfd8a0bb1511a5d1f29fef3a4f870b3f9bfab6f622a928c556d?arch=amd64&repository_url=registry.redhat.io/rhacm2/endpoint-monitoring-rhel9-operator&tag=1787324123

    Red Hat · CVE-2026-66804 · Updated 2026-10-16T17:26:04+00:00
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:b69db5c2aac4decf99a4c97c09e9c7055b642c4849f7e78d74f78877702428e8_amd64 as a component of multicluster engine for Kubernetes 2.10 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/addon-manager-rhel9@sha256%3Ab69db5c2aac4decf99a4c97c09e9c7055b642c4849f7e78d74f78877702428e8?arch=amd64&repository_url=registry.redhat.io/multicluster-engine/addon-manager-rhel9&tag=1786548877

    Red Hat · CVE-2026-66804 · Updated 2026-10-16T17:26:04+00:00
  • registry.redhat.io/multicluster-engine/work-rhel9@sha256:e89f1932aaabd42c5b7be791305a427f1fb811719296c1bddfac49edd771fa47_arm64 as a component of multicluster engine for Kubernetes 2.10 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/work-rhel9@sha256%3Ae89f1932aaabd42c5b7be791305a427f1fb811719296c1bddfac49edd771fa47?arch=arm64&repository_url=registry.redhat.io/multicluster-engine/work-rhel9&tag=1786933256

    Red Hat · CVE-2026-66804 · Updated 2026-10-16T17:26:04+00:00
  • registry.redhat.io/multicluster-engine/registration-rhel9@sha256:00f4181e21a2db39af730589b9151ec58b8b8279aa0a84291e599fb4e6e9799d_ppc64le as a component of multicluster engine for Kubernetes 2.11 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/registration-rhel9@sha256%3A00f4181e21a2db39af730589b9151ec58b8b8279aa0a84291e599fb4e6e9799d?arch=ppc64le&repository_url=registry.redhat.io/multicluster-engine/registration-rhel9&tag=1786911975

    Red Hat · CVE-2026-66804 · Updated 2026-10-16T17:26:04+00:00
  • registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:636fd81fbae261de28e76a4ad926a8ecb8710e9e5b09f2009e41a28d4ec54241_amd64 as a component of multicluster engine for Kubernetes 2.17 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/multicloud-manager-rhel9@sha256%3A636fd81fbae261de28e76a4ad926a8ecb8710e9e5b09f2009e41a28d4ec54241?arch=amd64&repository_url=registry.redhat.io/multicluster-engine/multicloud-manager-rhel9&tag=1786837080

    Red Hat · CVE-2026-66804 · Updated 2026-10-16T17:26:04+00:00
  • registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:a27ad391180c2c22638476e25765cd8c12cf1ccbf081c90966d9d67e20d8d703_amd64 as a component of multicluster engine for Kubernetes 2.6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/provider-credential-controller-rhel9@sha256%3Aa27ad391180c2c22638476e25765cd8c12cf1ccbf081c90966d9d67e20d8d703?arch=amd64&repository_url=registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9&tag=1787260821

    Red Hat · CVE-2026-66804 · Updated 2026-10-16T17:26:04+00:00
  • registry.redhat.io/multicluster-engine/work-rhel9@sha256:72de126319b24d646f98b1c5738088ebc658053fd4cba8d980732be506f49f4b_ppc64le as a component of multicluster engine for Kubernetes 2.8 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/work-rhel9@sha256%3A72de126319b24d646f98b1c5738088ebc658053fd4cba8d980732be506f49f4b?arch=ppc64le&repository_url=registry.redhat.io/multicluster-engine/work-rhel9&tag=1787259113

    Red Hat · CVE-2026-66804 · Updated 2026-10-16T17:26:04+00:00
  • registry.redhat.io/multicluster-engine/work-rhel9@sha256:f96d3832825177ec6388c1b5088b6380f9c0b3f6ec5a541e0f4a078f22382c8d_arm64 as a component of multicluster engine for Kubernetes 2.9 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/work-rhel9@sha256%3Af96d3832825177ec6388c1b5088b6380f9c0b3f6ec5a541e0f4a078f22382c8d?arch=arm64&repository_url=registry.redhat.io/multicluster-engine/work-rhel9&tag=1786933545

    Red Hat · CVE-2026-66804 · Updated 2026-10-16T17:26:04+00:00

Unverified PoC candidates

Catalogue matches for further research. These repositories have not been validated as working exploits.

4 candidates

Known Affected Software Configurations

VendorProductVersion range
MicrosoftWindows 10 22h2< 10.0.19045.7663
MicrosoftWindows 10 22h2< 10.0.19045.7663
MicrosoftWindows 10 22h2< 10.0.19045.7663
MicrosoftWindows 11 24h2< 10.0.26100.9106
MicrosoftWindows 11 24h2< 10.0.26100.9106
MicrosoftWindows 11 25h2< 10.0.26200.9106
MicrosoftWindows 11 25h2< 10.0.26200.9106
MicrosoftWindows 11 26h1< 10.0.28000.2704
MicrosoftWindows 11 26h1< 10.0.28000.2704

All CVSS metrics

  • HIGH 7.8 v3.1 · CNA Primary
    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
  • HIGH 7.8 v3.1 · NVD Secondary
    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Patches & mitigations

Advisories

Technical & other

Sources: NVD · CVE.org · All sources and attribution · EPSS