Microsoft Patches Windows 11 Get Help Flaw
Microsoft fixed a Windows 11 privilege escalation bug without issuing CVE identifiers, while paying a researcher for two diagnostics flaws.
Updated on Nov. 2, 2026 in Cybersecurity
Microsoft patched a Windows 11 Get Help flaw that could let standard users gain SYSTEM control, without assigning CVE identifiers. Researcher Ben Wilson of Tanto Security was paid US$16,000 in total for two diagnostics bugs.
Why it matters
The flaw could let any standard user launch the Diagnostic Execution Service without an administrator approval prompt, raising the stakes for users on shared machines. The absence of CVE identifiers means the vulnerability may be harder for security teams to track through standard vulnerability databases.
Two race conditions in the Media Creation Tool troubleshooter let a standard user swap in a malicious executable during download and have it run as SYSTEM. Microsoft has not issued CVE identifiers for the flaw, and the Calendar diagnostic bug has not been paid.
The players
Microsoft
Microsoft is the technology company that develops Windows and operates the Microsoft Security Response Centre, which handles vulnerability reports.
Ben Wilson
Ben Wilson is a security researcher at Tanto Security based in Melbourne who discovered and reported the Windows 11 Get Help flaws.
The details
The Get Help troubleshooting platform allowed a standard user to launch DiagSvc without an administrator prompt. Wilson exploited the Media Creation Tool troubleshooter script, which deleted and recreated a folder in a user-writable temporary directory before running the downloaded tool as SYSTEM. He reported the bug to the Microsoft Security Response Centre on May 13, and Microsoft confirmed the behaviour on June 29.
Timeline
May 13: Wilson reports the Media Creation Tool bug to the Microsoft Security Response Centre.
June 29: Microsoft confirms the Media Creation Tool behaviour.
June 30: Microsoft awards the bounty for the Media Creation Tool bug.
September 1: Microsoft's fix for the Media Creation Tool bug arrives.
September: Wilson presents the findings at BSides Canberra.
The Tech Race
Microsoft's bug bounty program continues to reward independent researchers who uncover privilege escalation flaws in Windows components. The decision to fix the Get Help flaw without CVE identifiers departs from common industry disclosure practice, which typically assigns identifiers to such bugs.
Windows 11 users on shared or multi-user machines face a risk that any standard account could gain full SYSTEM control through the Get Help flaw. Users should keep Windows updated to receive the September 1 fix for the Media Creation Tool bug.
The takeaway
Keeping Windows fully updated closes privilege escalation paths that standard accounts can exploit. Users on shared machines should review which accounts hold administrative rights.
Further reading
Explore more Cybersecurity coverage for context on vulnerability disclosure and privilege escalation threats.
