VulnerabilityPublished 26 Jan 2026

Bypassing Windows Administrator Protection

Source Google Project Zero

Severity

High

Rated by Threat Radar

Data as of 4 Aug 2026, 12:59 UTC

What to do

AI-suggested

All vulnerabilities described have been fixed by Microsoft in optional update KB5067036 and subsequent security bulletins. Users should ensure their Windows 11 systems are fully updated with the latest patches. The Administrator Protection feature is currently disabled by Microsoft due to an unrelated compatibility issue; monitor official Microsoft communications for re-enablement updates. No additional action is required beyond applying official updates.

Description

Windows 11 25H2 introduced a new Administrator Protection feature designed to replace User Account Control (UAC) with a more secure mechanism for granting administrator privileges. Research identified nine separate vulnerabilities that could bypass this feature to silently gain full administrator privileges. All reported issues have been fixed by Microsoft either before the official release or in subsequent security updates. As of December 2025, Microsoft temporarily disabled Administrator Protection due to an unrelated application compatibility issue. The feature aims to address longstanding weaknesses in UAC, which allowed silent privilege escalation through various bypass techniques. The new mechanism enforces a stronger security boundary between limited and administrator privileges.

Impact

If exploited, the vulnerabilities allowed a local user to silently gain full administrator privileges, bypassing the intended security boundary of Administrator Protection. This could enable unauthorized system modifications and elevate malware capabilities. However, all identified vulnerabilities have been fixed by Microsoft prior to or shortly after the feature's official release. The temporary disabling of Administrator Protection is unrelated to these vulnerabilities and does not affect the security fixes. There are no known exploits in the wild for these issues.

Summary

Administrator Protection in Windows 11 25H2 is a security feature intended to replace UAC by providing a more robust and securable system for local users to gain administrator privileges only when necessary. The research detailed nine distinct vulnerabilities that could bypass this protection to silently escalate privileges. These vulnerabilities were responsibly disclosed to Microsoft and have been fixed either in optional update KB5067036 or later security bulletins. The feature was temporarily disabled in December 2025 due to an unrelated compatibility issue. The feature addresses fundamental design flaws in UAC, such as shared user profiles and token impersonation weaknesses, and aims to prevent silent elevation of privileges that malware has exploited for years. The research and fixes improve the security boundary for administrator privilege elevation on Windows 11.

References

projectzero.google/2026/26/windows-administrator-protection.html (opens in a new tab)

Community reviews

Loading reviews…

What to do

Description

AI analysisMachine-generated, updated 4 Aug 2026, 12:59 UTC

References

Community reviews

Related threats