Bypassing Windows 11 Administrator Protection Allows Silent Elevation to Full Admin Rights
What Happened — Project Zero disclosed nine separate flaws in the newly‑introduced Administrator Protection feature of Windows 11 25H2. The feature was meant to replace UAC with a tighter, “securable” elevation mechanism. One of the flaws enables a low‑privilege process to silently obtain a full administrator token, bypassing the intended prompt. Microsoft addressed the issues in an optional update (KB5067036) and later via security bulletins; the feature was temporarily disabled on 1 Dec 2025 while an unrelated compatibility problem was resolved.
Why It Matters for Trust & Control Assurance — The vulnerability demonstrates that privileged‑access controls can be subverted, highlighting the need for continuous verification of elevation mechanisms.
Who Is Affected — Enterprises and individual users running Windows 11 25H2 (or earlier insider builds) that enable Administrator Protection.
Recommended Actions
- Deploy Microsoft’s KB5067036 (or later) to remediate the nine flaws.
- Verify that Administrator Protection is disabled or fully patched across the environment.
- Augment native OS controls with a dedicated privileged‑access management (PAM) solution that logs and enforces least‑privilege policies.
- Conduct regular audits of elevation prompts and token‑handling routines.
Technical Notes — The research identified nine distinct bypass techniques; one example manipulates token‑integrity checks to impersonate an elevated token without user consent. All findings were reported to Microsoft and have been patched. Source: https://projectzero.google/2026/26/windows-administrator-protection.html