Researcher shares zero-day Windows 10 local privilege escalation exploit that grants full control over files reserved for full-privilege users
A Windows zero-day exploit dropped by developer SandboxEscaper would allow local privilege-escalation (LPE), by importing legacy tasks from other systems into the Task Scheduler utility.
Context & Ripple Effects
This is SandboxEscaper's second run at the same component: a Task Scheduler zero-day disclosed last August already showed a local user could reach system privileges on Windows 10, and the researcher's new exploit reuses that attack surface — importing legacy tasks from other systems — to seize control of files reserved for full-privilege users. The difference is posture: rather than a coordinated report, this is a public drop of working exploit code against an unpatched flaw.
The disclosure style matters because of what followed the last cycle. After the earlier escalation bug, [[a:935594|Microsoft patched a Windows zero-day only once Kaspersky Lab observed multiple cyber-espionage groups exploiting it in the wild]] — evidence that unpatched local privilege escalation bugs in Windows get absorbed into real attack chains quickly, not just demonstrated in labs.
First-order effects
- Every Windows 10 machine — at the time the world's most-deployed desktop OS by usage share — carries an unpatched path to privileged-file control until Microsoft ships a fix, and any local user or malware already running with low rights can use the published code as-is.
Second-order effects
- Microsoft is pushed into emergency patch development outside its normal cadence, and enterprise defenders must treat the exploit as live threat intel immediately — the Kaspersky-documented espionage-group abuse of the previous Task Scheduler-class bug makes adoption by intrusion sets the base case, not the tail risk.
Third-order effects
- The corpus shows a repeating failure mode: Microsoft's fixes for these escalation bugs have themselves been incomplete, with one June patch leaving the underlying bug exploitable after adjustments and a later SYSTEM-privilege bypass defeating a patch within weeks — pointing toward a structural problem in Windows privilege separation that individual patches keep failing to close, and toward researchers losing patience with coordinated disclosure altogether.
The trend: Independent researchers are increasingly publishing unpatched Windows local privilege escalation exploits directly, with Task Scheduler and incomplete vendor patches turning each disclosure into a recurring cycle rather than a one-off.