# Privilege escalation security incidents · pwn.watch

> Security incidents tagged Privilege escalation (vendor, product, platform or attack type).

Page: https://pwn.watch/t/privilege-escalation · generated 2026-10-22T21:47:37.879Z

## Status (as of 2026-10-22)
- Incidents: 20 (1 live, 0 live and not fully patched, 20 patched)
- Days without a Privilege escalation security incident: 0
- Newest incident started: 2026-10-22

## Feeds
- JSON (incidents + changes + posts): https://pwn.watch/t/privilege-escalation.json
- RSS (one item per incident, bumped on each update): https://pwn.watch/t/privilege-escalation/feed.xml
- This file: https://pwn.watch/t/privilege-escalation/llms.txt
- Whole site: https://pwn.watch/llms.txt · all tags: https://pwn.watch/tags.json

## Incidents (newest first by start date)
- [Arista VeloCloud Orchestrator zero-day CVE-2026-114625 exploited in attacks](https://pwn.watch/i/arista-velocloud-orchestrator-cve-2026-114625) ([json](https://pwn.watch/i/arista-velocloud-orchestrator-cve-2026-114625.json)): critical, live, patched, started 2026-10-22, CVE-2026-114625
- [LiteSpeed Cache WordPress plugin: unauthenticated admin takeover (CVE-2024-28000)](https://pwn.watch/i/litespeed-cache-privilege-escalation-cve-2024-28000) ([json](https://pwn.watch/i/litespeed-cache-privilege-escalation-cve-2024-28000.json)): critical, closed, patched, started 2024-08-13, CVE-2024-28000
- [Linux kernel nf_tables use-after-free (CVE-2024-1086) used for root](https://pwn.watch/i/linux-kernel-nf-tables-use-after-free-cve-2024-1086) ([json](https://pwn.watch/i/linux-kernel-nf-tables-use-after-free-cve-2024-1086.json)): high, closed, patched, started 2024-01-31, CVE-2024-1086
- [Microsoft Windows: 3 exploited vulnerabilities (CVE-2023-36025, CVE-2023-36033, CVE-2023-36036)](https://pwn.watch/i/microsoft-windows-cve-2023-36025-36033-36036) ([json](https://pwn.watch/i/microsoft-windows-cve-2023-36025-36033-36036.json)): high, closed, patched, started 2023-11-14, CVE-2023-36025, CVE-2023-36033, CVE-2023-36036
- [Microsoft Skype for Business: Privilege Escalation (CVE-2023-41763)](https://pwn.watch/i/microsoft-skype-for-business-cve-2023-41763) ([json](https://pwn.watch/i/microsoft-skype-for-business-cve-2023-41763.json)): medium, closed, patched, started 2023-10-10, CVE-2023-41763
- [Apple iOS and iPadOS: Kernel Privilege Escalation (CVE-2023-42824)](https://pwn.watch/i/apple-ios-and-ipados-cve-2023-42824) ([json](https://pwn.watch/i/apple-ios-and-ipados-cve-2023-42824.json)): high, closed, patched, started 2023-10-05, CVE-2023-42824
- [Microsoft Windows CNG Key Isolation Service: Privilege Escalation (CVE-2023-28229)](https://pwn.watch/i/microsoft-windows-cng-key-isolation-service-cve-2023-28229) ([json](https://pwn.watch/i/microsoft-windows-cng-key-isolation-service-cve-2023-28229.json)): high, closed, patched, started 2023-10-04, CVE-2023-28229
- [Looney Tunables: glibc ld.so local root on most Linux distros (CVE-2023-4911)](https://pwn.watch/i/glibc-looney-tunables-cve-2023-4911) ([json](https://pwn.watch/i/glibc-looney-tunables-cve-2023-4911.json)): high, closed, patched, started 2023-10-03, CVE-2023-4911
- [Apple Multiple Products: 3 exploited vulnerabilities (CVE-2023-41991, CVE-2023-41992, CVE-2023-41993)](https://pwn.watch/i/apple-multiple-products-cve-2023-41991-41992-41993) ([json](https://pwn.watch/i/apple-multiple-products-cve-2023-41991-41992-41993.json)): high, closed, patched, started 2023-09-25, CVE-2023-41991, CVE-2023-41992, CVE-2023-41993
- [MinIO: Security Feature Bypass (CVE-2023-28434)](https://pwn.watch/i/minio-cve-2023-28434) ([json](https://pwn.watch/i/minio-cve-2023-28434.json)): high, closed, patched, started 2023-09-19, CVE-2023-28434
- [Android Framework: Privilege Escalation (CVE-2023-35674)](https://pwn.watch/i/android-framework-cve-2023-35674) ([json](https://pwn.watch/i/android-framework-cve-2023-35674.json)): high, closed, patched, started 2023-09-13, CVE-2023-35674
- [Microsoft Streaming Service Proxy: Privilege Escalation (CVE-2023-36802)](https://pwn.watch/i/microsoft-streaming-service-proxy-cve-2023-36802) ([json](https://pwn.watch/i/microsoft-streaming-service-proxy-cve-2023-36802.json)): high, closed, patched, started 2023-09-12, CVE-2023-36802
- [Microsoft Windows: 3 exploited vulnerabilities (CVE-2023-32046, CVE-2023-32049, CVE-2023-36874)](https://pwn.watch/i/microsoft-windows-cve-2023-32046-32049-36874) ([json](https://pwn.watch/i/microsoft-windows-cve-2023-32046-32049-36874.json)): high, closed, patched, started 2023-07-11, CVE-2023-32046, CVE-2023-32049, CVE-2023-36874
- [Microsoft Win32k: Privilege Escalation (CVE-2023-29336)](https://pwn.watch/i/microsoft-win32k-cve-2023-29336) ([json](https://pwn.watch/i/microsoft-win32k-cve-2023-29336.json)): high, closed, patched, started 2023-05-09, CVE-2023-29336
- [Android Framework: Privilege Escalation (CVE-2023-20963)](https://pwn.watch/i/android-framework-cve-2023-20963) ([json](https://pwn.watch/i/android-framework-cve-2023-20963.json)): high, closed, patched, started 2023-04-13, CVE-2023-20963
- [Microsoft Windows: Common Log File System (CLFS) Driver Privilege Escalation (CVE-2023-28252)](https://pwn.watch/i/microsoft-windows-cve-2023-28252) ([json](https://pwn.watch/i/microsoft-windows-cve-2023-28252.json)): high, closed, patched, started 2023-04-11, CVE-2023-28252
- [Linux Kernel: Use-After-Free (CVE-2023-0266)](https://pwn.watch/i/linux-kernel-cve-2023-0266) ([json](https://pwn.watch/i/linux-kernel-cve-2023-0266.json)): high, closed, patched, started 2023-03-30, CVE-2023-0266
- [Microsoft Windows: 2 exploited vulnerabilities (CVE-2023-21823, CVE-2023-23376)](https://pwn.watch/i/microsoft-windows-cve-2023-21823-23376) ([json](https://pwn.watch/i/microsoft-windows-cve-2023-21823-23376.json)): high, closed, patched, started 2023-02-14, CVE-2023-21823, CVE-2023-23376
- [Microsoft Exchange Server: Privilege Escalation (CVE-2022-41080)](https://pwn.watch/i/microsoft-exchange-server-cve-2022-41080) ([json](https://pwn.watch/i/microsoft-exchange-server-cve-2022-41080.json)): high, closed, patched, started 2023-01-10, CVE-2022-41080
- [Microsoft Windows: Advanced Local Procedure Call (ALPC) Privilege Escalation (CVE-2023-21674)](https://pwn.watch/i/microsoft-windows-cve-2023-21674) ([json](https://pwn.watch/i/microsoft-windows-cve-2023-21674.json)): high, closed, patched, started 2023-01-10, CVE-2023-21674