Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
CVE-2026-48581 Details
Description
Insufficient granularity of access control in Microsoft Surface allows an authorized attacker to elevate privileges locally.
A vulnerability in Microsoft Surface devices related to insufficient access control granularity allows authorized attackers to elevate privileges locally. This issue affects multiple Surface models, including the Surface Hub 3, Surface Pro 7+, Surface Go 3, Surface Laptop Go, Surface Laptop Go 3, Surface Pro 8, Surface Laptop 4 (Intel and AMD), Surface Go 2, Surface Hub 2S, and Surface Laptop Go 2. The vulnerability arises from inadequate access control measures, enabling privilege escalation to SYSTEM rights.
Surface devices receive updates through Windows Update. For manual update installation, check the update status in the Surface app under 'Help & support', and select 'Check for updates' to install available updates.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 22, 2026Exploitation: NoneAutomatable: NoTechnical Impact: Total
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48581 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1220 | Insufficient Granularity of Access Control | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| microsoft surface go 2 1901 firmware | All versions |
CPE
Remediation
| |
| microsoft surface go 2 1901 | All versions |
CPE
Remediation
| |
| microsoft surface go 2 1926 firmware | All versions |
CPE
Remediation
| |
| microsoft surface go 2 1926 | All versions |
CPE
Remediation
| |
| microsoft surface go 2 1927 firmware | All versions |
CPE
Remediation
| |
| microsoft surface go 2 1927 | All versions |
CPE
Remediation
| |
| microsoft surface go 3 1901 firmware | All versions |
CPE
Remediation
| |
| microsoft surface go 3 1901 | All versions |
CPE
Remediation
| |
| microsoft surface go 3 1926 firmware | All versions |
CPE
Remediation
| |
| microsoft surface go 3 1926 | All versions |
CPE
Remediation
| |
| microsoft surface go 3 2022 firmware | All versions |
CPE
Remediation
| |
| microsoft surface go 3 2022 | All versions |
CPE
Remediation
| |
| microsoft surface hub firmware | All versions |
CPE
Remediation
| |
| microsoft surface hub | All versions |
CPE
Remediation
| |
| microsoft surface hub 2s firmware | All versions |
CPE
Remediation
| |
| microsoft surface hub 2s | All versions |
CPE
Remediation
| |
| microsoft surface hub 2s 85 firmware | All versions |
CPE
Remediation
| |
| microsoft surface hub 2s 85 | All versions |
CPE
Remediation
| |
| microsoft surface hub 3 50 firmware | All versions |
CPE
Remediation
| |
| microsoft surface hub 3 50 | All versions |
CPE
Remediation
| |
| microsoft surface hub 3 85 firmware | All versions |
CPE
Remediation
| |
| microsoft surface hub 3 85 | All versions |
CPE
Remediation
| |
| microsoft surface laptop go 1943 firmware | All versions |
CPE
Remediation
| |
| microsoft surface laptop go 1943 | All versions |
CPE
Remediation
| |
| microsoft surface laptop go 2 2013 firmware | All versions |
CPE
Remediation
| |
| microsoft surface laptop go 2 2013 | All versions |
CPE
Remediation
| |
| microsoft surface laptop go 3 2013 firmware | All versions |
CPE
Remediation
| |
| microsoft surface laptop go 3 2013 | All versions |
CPE
Remediation
| |
| microsoft surface pro 7+ 1960 firmware | All versions |
CPE
Remediation
| |
| microsoft surface pro 7+ 1960 | All versions |
CPE
Remediation
| |
| microsoft surface pro 7+ with lte advanced 1961 firmware | All versions |
CPE
Remediation
| |
| microsoft surface pro 7+ with lte advanced 1961 | All versions |
CPE
Remediation
| |
| microsoft surface pro 8 1983 firmware | All versions |
CPE
Remediation
| |
| microsoft surface pro 8 1983 | All versions |
CPE
Remediation
| |
| microsoft surface pro 8 for business 1983 firmware | All versions |
CPE
Remediation
| |
| microsoft surface pro 8 for business 1983 | All versions |
CPE
Remediation
| |
| microsoft surface pro 8 for business with lte advanced 1982 firmware | All versions |
CPE
Remediation
| |
| microsoft surface pro 8 for business with lte advanced 1982 | All versions |
CPE
Remediation
| |
| microsoft surface laptop 4 1979 firmware | All versions |
CPE
Remediation
| |
| microsoft surface laptop 4 1979 | All versions |
CPE
Remediation
| |
| microsoft surface laptop 4 1950 firmware | All versions |
CPE
Remediation
| |
| microsoft surface laptop 4 1950 | All versions |
CPE
Remediation
| |
| microsoft surface laptop 4 1951 firmware | All versions |
CPE
Remediation
| |
| microsoft surface laptop 4 1951 | All versions |
CPE
Remediation
| |
| microsoft surface laptop 4 1952 firmware | All versions |
CPE
Remediation
| |
| microsoft surface laptop 4 1952 | All versions |
CPE
Remediation
| |
| microsoft surface laptop 4 1953 firmware | All versions |
CPE
Remediation
| |
| microsoft surface laptop 4 1953 | All versions |
CPE
Remediation
| |
| microsoft surface laptop 4 1958 firmware | All versions |
CPE
Remediation
| |
| microsoft surface laptop 4 1958 | All versions |
CPE
Remediation
| |
| microsoft surface laptop 4 1959 firmware | All versions |
CPE
Remediation
| |
| microsoft surface laptop 4 1959 | All versions |
CPE
Remediation
| |
| microsoft surface laptop 4 1978 firmware | All versions |
CPE
Remediation
| |
| microsoft surface laptop 4 1978 | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | Initial Analysis | [email protected] |
| Jul 23, 2026 | CVE Modified | CISA-ADP |
| Jul 14, 2026 | CVE Modified | CISA-ADP |
| Jul 14, 2026 | New CVE Received | [email protected] |