Security researchers have identified a privilege escalation vulnerability in Windows 11 that exploits the operating system's Plug and Play service to achieve SYSTEM-level access. The attack works by emulating a USB device, which triggers Windows to automatically fetch and install signed vendor software, including privileged installation components that can be chained together to escalate privileges on fully updated systems.
The vulnerability represents a significant security concern because it abuses legitimate Windows functionality rather than exploiting a traditional software bug. When a USB device is connected, Windows Plug and Play automatically searches for and installs appropriate drivers and software from trusted vendor sources. Attackers can manipulate this process by presenting a fake USB device that causes Windows to download and execute installation components with elevated privileges.
What makes this vulnerability particularly dangerous is that it can be triggered remotely without requiring physical access to the target machine. When Remote Desktop connections have Plug and Play or low-level USB redirection enabled, an attacker can exploit the same code path over the network. This remote attack vector significantly expands the potential impact beyond scenarios requiring physical device insertion.
The vulnerability affects fully patched Windows 11 systems, indicating that current security updates do not address this attack method. Because the exploit chain relies on signed vendor software and legitimate Windows services, traditional security controls may not detect or prevent the attack. The SYSTEM-level access gained through this method gives attackers complete control over the compromised machine, allowing them to install malware, steal data, or pivot to other systems on the network.
Organizations should immediately review their Remote Desktop Protocol configurations and disable USB redirection features unless absolutely necessary for business operations. Security teams should implement monitoring for unusual USB device enumeration events and suspicious driver installation activity. While Microsoft has acknowledged the issue, administrators should watch for an official security update and apply it promptly when available. Until a patch is released, limiting Remote Desktop access and implementing strict network segmentation can help reduce exposure to this attack vector.
Source: https://thehackernews.com/2026/08/researchers-turn-usb-auto-install-into.html