Microsoft Quietly Closed a Windows 11 Path From Standard User to SYSTEM, With No CVE to Track
A researcher found that Windows 11’s Get Help troubleshooters could let an ordinary user take full control of a PC. Microsoft fixed one flaw without issuing a CVE, which leaves admins nothing to check against. Here is how layered defenses help when the patch notes are silent.
Here Is How Layered Defenses Help When a Fix Ships Without a CVE
Many small businesses make a sensible choice: staff log in with standard accounts, not administrator ones, so a mistake or a malicious download cannot take over the whole machine. A researcher in Melbourne has shown that on Windows 11 that line could be crossed through an unlikely route, the built-in Get Help troubleshooters. Microsoft has fixed the flaw he reported, but it did so quietly and without a CVE identifier.
The account below comes from iTnews’ report on the research.
The short version
Get Help runs troubleshooting packages, which are bundles of PowerShell scripts hosted by Microsoft, through the Diagnostic Execution Service (DiagSvc). That service runs as SYSTEM, the highest privilege level on a Windows PC. Older troubleshooters asked for administrator approval first. Ben Wilson of Tanto Security found that on Windows 11, any standard user could start the service directly, with no prompt.
He focused on a troubleshooter that downloads and launches Microsoft’s Media Creation Tool. Its script built a folder in a temporary location that ordinary users could write to, downloaded the tool there and ran it as SYSTEM. By exploiting two small timing gaps, he first took control of that folder and then swapped his own program in for the real one, which the script then ran with full privileges.
The timeline
- May 13: Wilson reports the issue to the Microsoft Security Response Center.
- June 29: Microsoft confirms the behavior and awards a bounty the next day.
- Around September 1: Microsoft ships the fix, a one-line change to the PowerShell script. Wilson only noticed while recording a demonstration.
- September and last week: Wilson presents the research at BSides Canberra and Kawaiicon in Wellington.
Microsoft paid US$8,000 for this bug and the same amount for a second flaw in the Outlook diagnostic package. A third issue, in the Calendar diagnostic package, is still in disclosure. Wilson says he has received no CVEs and is not sure he ever will, and he has not yet tested whether the fix can be bypassed. To his knowledge, the Media Creation Tool flaw has not been exploited in the wild.
Why a missing CVE matters
Most patch reports, vulnerability scanners and compliance checklists are organized around CVE numbers. When a fix arrives without one, there is no identifier to search for and no advisory to confirm you are covered. You are protected only if your normal update process reached the machine.
The layers that still work
- Keep updates flowing automatically. When fixes arrive quietly, routine patching is the only thing that catches them. Make sure Windows Update, or your management tool such as Microsoft Intune or a comparable RMM platform, is installing updates on every PC and reporting failures.
- Keep users on standard accounts anyway. This research does not make least privilege pointless. Attackers still need a way to elevate, and every hurdle helps.
- Control what can run. Application control tools, such as Windows Defender Application Control, AppLocker or third-party allow-listing, can block unknown executables, including one swapped into a temporary folder.
- Watch for unusual SYSTEM activity. Endpoint detection and response tools, for example Microsoft Defender for Endpoint or a similar product, can alert when a system service launches an unexpected program.
- Limit the blast radius. Use separate admin accounts, unique local administrator passwords (for example through Windows LAPS) and network segmentation, so one compromised PC does not become a compromised network.
What this means for your company
Nobody can track every quiet fix. What you can do is make sure the basics work without anyone watching: updates install on schedule, everyday accounts stay standard, unknown programs cannot simply run, and someone is alerted when a PC does something it should not. Those layers protect you from the flaws that get CVEs and from the ones that never do.
Want to know whether every Windows PC in your office is actually receiving updates and running with least privilege? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
