CVE-2026-61925

This CVE is not an initial access vector — it's a lateral movement and persistence mechanism that activates after you already have a foothold. The 'authorized attacker' qualifier is the analytical hinge: it means the vulnerability requires legitimate Windows Installer access, then exploits the repair functionality to escalate from a constrained user context to SYSTEM or administrator privileges. The CVSS 7.8 reflects how easy that escalation is once authorized, not the severity of the overall attack chain. The pattern is well-established: MSI repair operations execute privileged actions against files, folders, and registry keys that standard users can partially control. If an installer's component rules left any repair target writable by non-privileged users, triggering a repair — whether manually, via deployment tools, or through automated troubleshooting — executes SYSTEM-level operations against a controllable resource. This is the same class of vulnerability we've seen in CVE-2020-1147, CVE-2012-2519, and others; Microsoft typically patches the specific misconfiguration rather than the repair mechanism itself. Two practical priorities for defenders. First, treat this as a supply chain pivot point rather than a workstation vulnerability. If your software deployment infrastructure (SCCM, Intune, group policy) triggers MSI repairs — and many do as a troubleshooting mechanism — then any compromised machine or service account with deployment rights becomes a SYSTEM escalation vector across your entire managed fleet. The 'authorized' set is larger than you think. Second, inventory your MSI-based deployments: identify which installers have writable components in their repair paths, audit who can trigger repairs and in what context, and prioritize remediating installers used across many machines rather than chasing every instance. The uncomfortable truth is that this vulnerability class persists because the repair mechanism is architectural, not incidental. Microsoft won't retire it — too many workflows depend on it. The ecosystem fix is shifting your focus from patching individual CVEs to reducing the attack surface of your deployment pipeline itself. Treat any MSI repair triggered from a managed context as a privilege escalation risk until proven otherwise.

Reviewed through automated stages and approved by a human before publication.