Back to CVE records
High 7.8Published Jul 14, 2026
CVE-2026-48581Surface Broker SDMA Elevation of Privilege Vulnerability
Updated under an hour ago ()
Does this affect you?
It affects Microsoft Surface Go and 35 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Start free and add your stack
Free account, 1 product
Insufficient granularity of access control in Microsoft Surface allows an authorized attacker to elevate privileges locally.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
- Weakness (CWE)
- CWE-1220
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- microsoft
- NVD analysis
- Analyzed
- Record last updated
- Oct 8, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Microsoft Microsoft Surface Go microsoft:surface_go (from the name) | - | CNA record |
Microsoft Microsoft Surface Hub microsoft:surface_hub (from the name) | - | CNA record |
Microsoft Microsoft Surface Laptop Go microsoft:surface_laptop_go (from the name) | - | CNA record |
Microsoft Microsoft Surface Laptop Go 3 microsoft:surface_laptop_go_3 (from the name) | - | CNA record |
Microsoft Microsoft Surface Pro microsoft:surface_pro (from the name) | - | CNA record |
Microsoft Microsoft Surface Pro 8 microsoft:surface_pro_8 (from the name) | - | CNA record |
Microsoft Surface Laptop 4 with AMD Processor microsoft:surface_laptop_4_with_amd_processor (from the name) | - | CNA record |
Microsoft Surface Laptop 4 with Intel Processor microsoft:surface_laptop_4_with_intel_processor (from the name) | - | CNA record |
Microsoft Surface Windows Dev Kit microsoft:surface_windows_dev_kit (from the name) | - | CNA record |
microsoft surface_go_2_1901_firmware microsoft:surface_go_2_1901_firmware | all versions | NVD |
microsoft surface_go_2_1926_firmware microsoft:surface_go_2_1926_firmware | all versions | NVD |
microsoft surface_go_2_1927_firmware microsoft:surface_go_2_1927_firmware | all versions | NVD |
microsoft surface_go_3_1901_firmware microsoft:surface_go_3_1901_firmware | all versions | NVD |
microsoft surface_go_3_1926_firmware microsoft:surface_go_3_1926_firmware | all versions | NVD |
microsoft surface_go_3_2022_firmware microsoft:surface_go_3_2022_firmware | all versions | NVD |
microsoft surface_hub_firmware microsoft:surface_hub_firmware | all versions | NVD |
microsoft surface_hub_2s_firmware microsoft:surface_hub_2s_firmware | all versions | NVD |
microsoft surface_hub_2s_85_firmware microsoft:surface_hub_2s_85_firmware | all versions | NVD |
microsoft surface_hub_3_50_firmware microsoft:surface_hub_3_50_firmware | all versions | NVD |
microsoft surface_hub_3_85_firmware microsoft:surface_hub_3_85_firmware | all versions | NVD |
microsoft surface_laptop_go_1943_firmware microsoft:surface_laptop_go_1943_firmware | all versions | NVD |
microsoft surface_laptop_go_2_2013_firmware microsoft:surface_laptop_go_2_2013_firmware | all versions | NVD |
microsoft surface_laptop_go_3_2013_firmware microsoft:surface_laptop_go_3_2013_firmware | all versions | NVD |
microsoft surface_pro_7+_1960_firmware microsoft:surface_pro_7+_1960_firmware | all versions | NVD |
microsoft surface_pro_7+_with_lte_advanced_1961_firmware microsoft:surface_pro_7+_with_lte_advanced_1961_firmware | all versions | NVD |
microsoft surface_pro_8_1983_firmware microsoft:surface_pro_8_1983_firmware | all versions | NVD |
microsoft surface_pro_8_for_business_1983_firmware microsoft:surface_pro_8_for_business_1983_firmware | all versions | NVD |
microsoft surface_pro_8_for_business_with_lte_advanced_1982_firmware microsoft:surface_pro_8_for_business_with_lte_advanced_1982_firmware | all versions | NVD |
microsoft surface_laptop_4_1979_firmware microsoft:surface_laptop_4_1979_firmware | all versions | NVD |
microsoft surface_laptop_4_1950_firmware microsoft:surface_laptop_4_1950_firmware | all versions | NVD |
microsoft surface_laptop_4_1951_firmware microsoft:surface_laptop_4_1951_firmware | all versions | NVD |
microsoft surface_laptop_4_1952_firmware microsoft:surface_laptop_4_1952_firmware | all versions | NVD |
microsoft surface_laptop_4_1953_firmware microsoft:surface_laptop_4_1953_firmware | all versions | NVD |
microsoft surface_laptop_4_1958_firmware microsoft:surface_laptop_4_1958_firmware | all versions | NVD |
microsoft surface_laptop_4_1959_firmware microsoft:surface_laptop_4_1959_firmware | all versions | NVD |
microsoft surface_laptop_4_1978_firmware microsoft:surface_laptop_4_1978_firmware | all versions | NVD |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48581vendor-advisory, patch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.