PoC Exploit Publicly Disclosed: ‘RegPwn’ Flaw Grants SYSTEM Access via Windows Accessibility

A recently disclosed Windows local privilege escalation dubbed RegPwn (CVE-2026-24291) exploits incorrect permissions in ATBroker.exe to allow a low-privileged user to force SYSTEM-level arbitrary registry writes via registry symbolic links and an oplock race, enabling replacement of a service ImagePath and SYSTEM code execution; Microsoft has issued a Patch Tuesday fix and the vulnerability carries a CVSS of 7.8.