Kaspersky Researcher Discovers Unpatched Windows Privilege Escalation Flaw
AI-generated from multiple sources. Verify before acting on this reporting.
MOSCOW (AP) — A security researcher from Kaspersky has identified a new privilege escalation vulnerability in Microsoft Windows that allows attackers to gain System-level access without requiring a software patch.
Haidar Kabibo, a researcher at the cybersecurity firm, detailed the technique, dubbed PhantomRPC, on Monday. The flaw stems from an architectural weakness within the Windows Remote Procedure Call (RPC) mechanism. This vulnerability permits malicious actors to impersonate system services, effectively bypassing standard security controls to elevate their privileges to the highest level available on the operating system.
The discovery marks a significant development in Windows security, as the vulnerability does not rely on a missing patch or a traditional software bug that can be fixed with an update. Instead, the issue is embedded in the design of the RPC infrastructure, which manages communication between different software components. By exploiting this design flaw, attackers can manipulate the system to grant them administrative rights that would otherwise be restricted.
Microsoft has not yet issued a patch for the vulnerability, and the company has not publicly commented on the specific technical details provided by Kabibo. The PhantomRPC technique represents a shift in how attackers might target enterprise and consumer Windows environments, as it circumvents the standard patching cycle that organizations rely on for protection.
The vulnerability affects the core operating system architecture, meaning it could impact a wide range of Windows versions and configurations. Security experts warn that the ability to escalate privileges to System level without a patch creates a persistent risk for organizations that cannot immediately replace or redesign their underlying infrastructure.
Kabibo's findings were released as part of a broader analysis of Windows security mechanisms. The researcher noted that the flaw allows for the impersonation of services, a technique that has historically been difficult to execute without prior access to elevated credentials. The PhantomRPC method simplifies this process, potentially lowering the barrier for attackers seeking to compromise high-value targets.
As of Monday, it remains unclear how widely the vulnerability has been exploited in the wild. Security firms are currently assessing the potential impact on enterprise networks and are developing mitigation strategies that do not rely on a software update. Microsoft has not announced a timeline for addressing the architectural weakness, leaving organizations to weigh the risks of continued exposure against the potential instability of untested workarounds.
The discovery highlights ongoing challenges in securing complex operating systems where architectural decisions made years ago can create vulnerabilities that persist despite regular security updates. Researchers are now monitoring for any public disclosure of exploits leveraging the PhantomRPC technique, while Microsoft faces pressure to address the fundamental design flaw.