Cyber Resilience

CVE-2026-48581

Microsoft Surface Go 2 1901 Firmware

Published
14 July 2026
Modified
24 July 2026
Patch / advisory
CVSS Score v3.1 7.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0021 12th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-48581 is a high-severity Insufficient Granularity of Access Control (CWE-1220) vulnerability in Microsoft Surface Go 2 1901 Firmware. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 12th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

Insufficient granularity of access control in Microsoft Surface allows an authorized attacker to elevate privileges locally.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

Direct local privilege escalation via insufficient access control granularity maps to exploitation for privilege escalation.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-56155Same vendor: Microsoft
CVE-2026-50405Same vendor: Microsoft
CVE-2026-55006Same vendor: Microsoft
CVE-2026-33825Same vendor: Microsoft
CVE-2026-35436Same vendor: Microsoft
CVE-2026-40365Same vendor: Microsoft
CVE-2026-49170Same vendor: Microsoft
CVE-2024-43604Same vendor: Microsoft
CVE-2023-33127Same vendor: Microsoft
CVE-2024-26246Same vendor: Microsoft

Affected Assets

microsoft
surface go 2 1901 firmware
all versions
microsoft
surface go 2 1926 firmware
all versions
microsoft
surface go 2 1927 firmware
all versions
microsoft
surface go 3 1901 firmware
all versions
microsoft
surface go 3 1926 firmware
all versions
microsoft
surface go 3 2022 firmware
all versions
microsoft
surface hub firmware
all versions
microsoft
surface hub 2s firmware
all versions
microsoft
surface hub 2s 85 firmware
all versions
microsoft
surface hub 3 50 firmware
all versions
+17 more product configuration(s) — see NVD for full list

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • AC-3 Access Enforcement
  • AC-6 Least Privilege
  • AC-16 Security and Privacy Attributes
Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)
  • 4 hardening rules · 4 OS baselines
Validate
Prove the fix (OWASP ASVS)
  • V16.4.2
  • V8.4.2
  • V11.7.1
  • V13.2.4

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly enforces granular access control policies to block the unauthorized local privilege elevation described in the CVE.

prevent

Requires processes and users to operate with the minimum necessary privileges, directly countering insufficient granularity that enables local escalation.

prevent

Uses security attributes to support finer-grained access decisions, mitigating the root weakness of overly coarse controls on Microsoft Surface.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.IR-01 mostly match
prevents

PR.IR-01's segmentation + zero-trust rules directly enforce minimum-necessary access at network boundaries, removing most instances of overly broad policy; CWE-1220 can still exist in application-layer or intra-segment controls that this single outcome does not address.

PR.PS-06 partial match
prevents

PR.PS-06's general SDLC practices can surface granularity issues during design/review (partial prevention) but do not specifically target access-control policy breadth, so they remove only part of CWE-1220's risk.

DE.AE-06 none match
is degraded by

CWE-1220 permits unauthorized access to sensitive assets but neither prevents nor impairs the delivery of adverse-event information to authorized recipients.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

degrades

Directly requires information-access restriction at the level of individual assets and operations, addressing the granularity gap.

prevents

Establishes the overarching access-control policy whose granularity directly determines whether the weakness exists.

prevents

Defines the assignment and review of access rights; insufficient granularity in those rights is the root of CWE-1220.

prevents

Specifies management of privileged access rights, where overly broad privileges are a common manifestation of the weakness.

none

Limits use of privileged utilities; overly coarse access rules can still allow unauthorized utility access.

References