Improper access control in Windows Cross Device Service

CVE-2026-66804 is a local elevation-of-privilege flaw in the Windows Cross Device Service (CrossDeviceService), the background process that powers the Phone Link / Mobile Devices experience on Windows 11 22H2, 23H2, 24H2, and Windows Server 2025/2022 23H2 (Server Core). The service loads DLLs from C:\ProgramData\CrossDevice, a directory writable by standard users. A low-privileged local attacker can plant a malicious DLL in that path; when the service next loads it, code executes as SYSTEM. The pattern is identical to the earlier CVE-2025-24076 (CVSS 7.3) in the same component, which already has a public Exploit-DB PoC (EDB-52320). Affected builds are everything prior to the August 11, 2026 cumulative update.

Microsoft rates this Important / 7.8, which is technically fair for the raw CVSS math — local access, low complexity, low privilege, full CIA impact. But the vendor score ignores three practical realities: (1) exploitation requires the attacker to already have code execution on the target as a standard user, meaning initial access is a prerequisite; (2) the Cross Device Service is a consumer-facing phone-linking feature that most enterprises either never enable or actively disable via policy; (3) no in-the-wild exploitation, no KEV listing, and EPSS sits at the 3rd percentile. The temporal score (6.8) already hints at this gap. For a fleet of 10,000 managed desktops, this is a useful post-compromise garnish — not a primary attack vector.

Why this verdict

• Local-only vector compounds friction. AV:L means the attacker must already be on the box. This is a privilege-escalation link in a chain, not an entry point. Every host with EDR adds a detection gate before step 1 even begins.
• Consumer-oriented service with low enterprise footprint. The Cross Device Service powers Phone Link — a feature many enterprises disable via GPO (Computer Configuration > Administrative Templates > System > Group Policy > Phone-PC linking) or strip from their SOE image entirely. The reachable population on a managed fleet is likely <30%.
• No active exploitation, no KEV, EPSS 3rd percentile. There is zero threat-intelligence pressure to accelerate this patch. The temporal score already discounts to 6.8.
• Role multiplier: Cross Device Service is *not* a high-value-role component. It does not run on domain controllers, hypervisors, identity providers, backup servers, or CI/CD infrastructure in any standard deployment. On Windows Server 2025 the feature is present but rarely enabled. The blast radius is single-host SYSTEM — useful for an attacker who is already inside, but it does not unlock domain-scale or fleet-scale compromise. No floor override applies.
• Predecessor PoC lowers exploit-development cost. The CVE-2025-24076 PoC on Exploit-DB is directly adaptable, which prevents a full downgrade to LOW. A motivated attacker with local access could weaponize this quickly.

Why not higher?

The vendor's HIGH (7.8) is a pure CVSS base-score artifact. The local-access prerequisite, consumer-service scope, absence of any remote or network vector, no active exploitation, and no high-value-role relevance all compound to reduce real-world risk well below HIGH. There is no scenario where this single vulnerability alone gives an attacker entry to a network or scales beyond one host.

Why not lower?

A full downgrade to LOW would underweight the fact that a weaponized PoC for an identical pattern already exists publicly and the exploit requires no user interaction (UI:N). On endpoints where the Cross Device Service is running, any standard user can reach SYSTEM with minimal complexity. That reliable local priv-esc still has value in red-team chains and post-compromise scenarios.

1. Disable or remove the Cross Device Service via GPO or DISM — Set the Group Policy Computer Configuration > Administrative Templates > System > Group Policy > Configure phone-PC linking on this device to Disabled, or run DISM /Online /Remove-Capability /CapabilityName:CrossDevice~~~~ on your golden image. This eliminates the attack surface entirely. No noisgate mitigation SLA applies for MEDIUM — go straight to the 365-day remediation window for the patch itself.
2. Restrict writes to C:\ProgramData\CrossDevice via NTFS ACL — Remove write permissions for the Users and Authenticated Users groups on C:\ProgramData\CrossDevice. This breaks the DLL-plant step without disabling the service. Test in a pilot ring first — Phone Link may stop working.
3. Deploy WDAC or AppLocker DLL rules for ProgramData — Create a code-integrity rule that blocks unsigned or untrusted DLLs from loading out of C:\ProgramData\*. This catches this CVE and the entire class of ProgramData DLL-hijack vulnerabilities.
4. Monitor with Sysmon or EDR for DLL loads from CrossDevice path — Alert on Sysmon Event ID 7 where ImageLoaded matches C:\ProgramData\CrossDevice\*.dll and the signature status is unsigned. This gives detection-in-depth while you schedule the patch.

Run this on each target Windows host as any user (no admin required). Example: powershell -ExecutionPolicy Bypass -File .\Check-CVE-2026-66804.ps1. It checks whether the Cross Device Service is present and whether the August 2026 patch is installed.

#Requires -Version 5.1
<# Check-CVE-2026-66804.ps1
   Checks whether the host is vulnerable to CVE-2026-66804
   (Windows Cross Device Service EoP via DLL hijack).
   Output: VULNERABLE / PATCHED / UNKNOWN
   Exit codes: 1 = VULNERABLE, 0 = PATCHED, 2 = UNKNOWN
#>

$ErrorActionPreference = 'Stop'

# 1. Check if Cross Device Service capability is present
$capability = Get-WindowsCapability -Online -Name 'CrossDevice*' 2>$null
$servicePresent = $false
if ($capability -and $capability.State -eq 'Installed') {
    $servicePresent = $true
}

if (-not $servicePresent) {
    Write-Host 'PATCHED - Cross Device capability is not installed on this host. Not vulnerable.'
    exit 0
}

# 2. Check OS build for August 2026 patch level
try {
    $build = [System.Environment]::OSVersion.Version
    $ubr = (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name UBR).UBR
    $fullBuild = "$($build.Build).$ubr"
    Write-Host "OS Build: $fullBuild"

    # August 2026 patches - build thresholds (approximate; adjust per your SKU)
    # Win11 24H2: 26100.33222+
    # Win11 23H2: 22631.xxxxx (check your CU KB)
    $patchedBuilds = @{
        26100 = 33222   # 24H2 / Server 2025
        22631 = 50000   # 23H2 placeholder - adjust to actual patched UBR
        22621 = 50000   # 22H2 placeholder - adjust to actual patched UBR
    }

    if ($patchedBuilds.ContainsKey($build.Build)) {
        $requiredUBR = $patchedBuilds[$build.Build]
        if ($ubr -ge $requiredUBR) {
            Write-Host "PATCHED - Build $fullBuild meets or exceeds the August 2026 fix."
            exit 0
        } else {
            Write-Host "VULNERABLE - Build $fullBuild is below the patched UBR ($requiredUBR). Cross Device Service is installed."
            exit 1
        }
    } else {
        Write-Host "UNKNOWN - OS build $($build.Build) not in check list. Verify manually."
        exit 2
    }
} catch {
    Write-Host "UNKNOWN - Error querying OS version: $_"
    exit 2
}

Sources

1. SANS ISC - Microsoft Patch Tuesday August 2026
2. Talos Intelligence - Microsoft Patch Tuesday August 2026
3. Tenable - August 2026 Patch Tuesday (398 CVEs)
4. Exploit-DB #52320 - Cross Device Service EoP PoC (CVE-2025-24076)
5. Microsoft Support - KB5120228 Server 2025 August 2026
6. Petri - August 2026 Patch Tuesday Overview