Windows 11 Flaw Gave Standard Users SYSTEM
The Get Help troubleshooter flaw is patched, but Microsoft has not issued CVE identifiers for the related Media Creation Tool bug.
Updated on Nov. 2, 2026 in Cybersecurity
Microsoft fixed a privilege escalation flaw in the Get Help troubleshooting platform in Windows 11 that let standard users gain SYSTEM control, without issuing CVE identifiers. The flaw was reported by researcher Ben Wilson of Tanto Security, and the fix is shipped as a patch rather than a research-stage result.
Why it matters
The bug shows how diagnostic and troubleshooting tools that run with elevated privileges can become a route for privilege escalation on consumer operating systems. Because Microsoft did not assign CVE identifiers, the disclosure is harder for enterprise security teams to track through standard vulnerability feeds.
The disclosed payments total US$16,000 across two diagnostics bugs, with each paid bounty at US$8000. The Media Creation Tool flaw has not been exploited in the wild to the best of the researcher's knowledge, and the third bug remains unpaid and in disclosure.
The players
Microsoft
Microsoft develops Windows 11 and runs the Microsoft Security Response Centre, which handles vulnerability reports and bounty payments.
Ben Wilson
Ben Wilson is a security researcher at Tanto Security in Melbourne who reported the Get Help and Media Creation Tool flaws.
The details
Windows troubleshooters are scripts that run with elevated rights to diagnose and repair system problems. In the Media Creation Tool case, the troubleshooter script deleted and recreated a folder in a user-writable temporary directory, then ran the downloaded tool as SYSTEM, the highest-privilege account on Windows. Wilson exploited two race conditions, timing points where the outcome depends on the order of operations, by creating the folder first and swapping in his own executable during the download.
Timeline
May 13: Wilson reported the Media Creation Tool bug to the Microsoft Security Response Centre.
June 29: Microsoft confirmed the Media Creation Tool behaviour.
June 30: Microsoft awarded the bounty for the Media Creation Tool bug.
September 1: Microsoft's fix for the Media Creation Tool bug arrived.
September: Wilson presented the talk at BSides Canberra.
The Tech Race
The disclosure places Microsoft's Get Help and Media Creation Tool troubleshooters in the same class of elevated diagnostic code that has repeatedly drawn bounty-paid vulnerability reports. The case is a concrete example of how vendors are paying researchers to find privilege escalation paths inside built-in repair tools.
Users of Windows 11 with standard accounts could have been able to gain SYSTEM control through the Get Help flaw until the fix was applied. Users should install the Windows updates that include the fix to close the path.
The takeaway
Watch whether Microsoft assigns CVE identifiers to the Media Creation Tool flaw and whether the Calendar diagnostic bug is paid once disclosure closes. Both would show how the company handles elevated troubleshooting bugs from here.
Further reading
For broader context on how these flaws are handled, see the Cybersecurity section.
Source note: This article includes information reported by ITnews.
