CVE-2026-28616: Security vulnerability
Published Sep 8, 2026
·Updated
In Setup Wizard, there is a possible way to force connection to a malicious network due to confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Event History
Sep 8, 2026
CVE Published
via MITRE·06:04 PM
Data Sourced
via MITRE·06:04 PM
DescriptionWeakness
Frequently Asked Questions
1
What access does an attacker need to exploit this issue?
The issue can be exploited without user interaction and requires no additional execution privileges. The described impact is local escalation of privilege.
2
What is the immediate risk if exploitation succeeds?
An attacker may be able to force Setup Wizard to connect to a malicious network through a confused-deputy condition. This can result in local privilege escalation.