Series

Windows Service Trust Boundaries

Public technical analyses of authorization and trust-boundary failures in default Windows services. Entries appear only after the corresponding vendor disclosure.

This page lists public work only. Vendor-coordinated findings appear after the corresponding disclosure and applicable technical-publication window.

All notes
  1. Part 1 Teardown Sep 8, 2026

    CVE-2026-69321: Windows Power Dependency Coordinator Tampering Vulnerability

    CVE-2026-69321 root cause, patch diff, and CVSS 5.5 rating: six umpo.dll RPC handlers in Windows Power Dependency Coordinator skipped the caller check.

    Read the teardown