No Patch for New PhantomRPC Privilege Escalation Technique in Windows
Source SecurityWeek
Rated Medium by SecurityWeek
Data as of 28 Apr 2026, 11:36 UTC
What to do
AI-suggested
Microsoft has classified the vulnerability as moderate severity and has indicated that immediate remediation is not required. Organizations should monitor vendor advisories for updates. Since exploitation requires compromising privileged services and deploying fake RPC servers, restricting local access and maintaining strong service account security may reduce risk.
Description
PhantomRPC is a local privilege escalation vulnerability in Windows RPC that allows an attacker to impersonate privileged services by deploying a fake RPC server. This architectural weakness enables escalation to System privileges by intercepting RPC requests intended for legitimate services. The issue affects multiple Windows versions and exploits legitimate Windows impersonation mechanisms. Kaspersky reported the vulnerability, and Microsoft has classified it as moderate severity, stating it does not require immediate remediation. No official patch is currently available. Exploitation requires compromising a privileged service and setting up a fake RPC server to intercept and impersonate RPC calls. Several attack paths have been identified involving services running under Network Service and Local Service accounts. The vulnerability increases the attack surface for local privilege escalation but requires specific conditions to exploit.