EIP-2026-117519
PRE-CVEMicrosoft Windows - AlwaysInstallElevated MSI (Metasploit)
Title source: legacyExploitation Summary
EIP tracks 1 public exploit for EIP-2026-117519. PoCs published by Metasploit.
AI-analyzed exploit summary This Metasploit module exploits the AlwaysInstallElevated registry key misconfiguration to execute an MSI file with SYSTEM privileges, achieving local privilege escalation. It checks registry values, uploads a malicious MSI and payload, and executes them via msiexec.exe.
Description
Microsoft Windows - AlwaysInstallElevated MSI (Metasploit)
Exploits (1)
exploitdb
WORKING POC
VERIFIED
by Metasploit · rubylocalwindows
https://www.exploit-db.com/exploits/23007
This Metasploit module exploits the AlwaysInstallElevated registry key misconfiguration to execute an MSI file with SYSTEM privileges, achieving local privilege escalation. It checks registry values, uploads a malicious MSI and payload, and executes them via msiexec.exe.
Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target:
Windows (registry-based misconfiguration)
Auth required
Prerequisites:
AlwaysInstallElevated registry keys set to 1 in HKLM or HKCU · Write access to %TEMP% directory
devstral-2 · analyzed Feb 19, 2026
Full analysis →
Details
Status
pre_cve
Tracked Since
Feb 18, 2026