ZDI-26-606: Windows Compatibility Appraiser Link-Following Privilege Escalation — Detection and Remediation Guide

The Zero Day Initiative has published ZDI-26-606, a local privilege escalation vulnerability in the Microsoft Windows Compatibility Appraiser — the telemetry and application-compatibility component most practitioners know by its executable, CompatTelRunner.exe. The flaw carries a CVSS score of 7.0 (High) and, per ZDI's advisory, allows a local attacker who has already achieved code execution in the context of the LOCAL SERVICE account to escalate privileges on the affected system — in practice, to NT AUTHORITY\SYSTEM.

If that attack chain sounds familiar, it should. Windows has a long, painful history of privileged system components following attacker-controlled links — junctions, symlinks, and object manager symbolic links — to files and directories the attacker planted in low-integrity locations. CVE-2025-class link-following bugs in scheduled tasks and telemetry services have been a recurring theme in Microsoft's monthly patch cycles, and ZDI-26-606 fits the pattern: a SYSTEM-integrity component performing file operations on a path that a lower-privileged principal can redirect.

The critical framing for defenders: this is not a remote code execution bug and not an initial access vector. It is the second stage of a compromise — the rung an attacker climbs after landing inside a service context. That makes it extremely relevant to anyone running IIS, SQL Server, or other network-facing services that execute as LOCAL SERVICE or NETWORK SERVICE, because a web shell or service-side RCE combined with ZDI-26-606 yields full SYSTEM control of the host.

Technical Analysis

Affected Component and Exploitation Requirements

• Affected product: Microsoft Windows — the Compatibility Appraiser component of the Application Experience infrastructure (CompatTelRunner.exe), typically invoked via the scheduled task \Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser. The advisory applies to supported Windows client and server builds; consult the ZDI advisory and the Microsoft Security Update Guide for the authoritative product/version matrix once Microsoft's corresponding update is published.
• Advisory ID: ZDI-26-606 (no CVE identifier has been published in the source material at time of writing — track the ZDI advisory page for the CVE assignment).
• CVSS: 7.0 (High). The score reflects a local attack vector with a prerequisite: the attacker must already execute low-privileged code in the context of LOCAL SERVICE.
• Vulnerability class: Link following (CWE-59 — Improper Link Resolution Before File Access). The privileged Compatibility Appraiser process performs a file or directory operation on a path whose final or intermediate component can be redirected by the attacker using NTFS junctions, symbolic links, or object manager symlinks, causing the SYSTEM-context process to act on an arbitrary attacker-chosen target — typically to overwrite, create, or take ownership of a protected file, or to place attacker-controlled content where a privileged loader will consume it.

The Attack Chain from a Defender's Perspective

1. Stage 1 — Foothold: Attacker gains code execution as LOCAL SERVICE. Real-world vectors include deserialization or injection flaws in services running under that account, or webshell-to-service pivots on exposed servers.
2. Stage 2 — Link placement: From the LOCAL SERVICE context, the attacker creates a junction/symlink in a filesystem location the Compatibility Appraiser reads or writes — commonly under user- or service-writable telemetry paths (e.g., locations beneath %ProgramData% associated with Application Experience telemetry).
3. Stage 3 — Trigger: The attacker triggers (or waits for) the Compatibility Appraiser scheduled task, which runs CompatTelRunner.exe as SYSTEM. The task follows the attacker-planted link and performs a privileged file operation on the redirected target.
4. Stage 4 — Escalation: The privileged write/redirect is leveraged into code execution as SYSTEM — classically via DLL planting into a system directory, overwriting a binary or configuration consumed by a SYSTEM service, or abusing the privileged operation to alter ACLs.

Exploitation Status

At the time of writing, ZDI has published the advisory with a CVSS 7.0 rating; the advisory text indicates the vulnerability was reported to Microsoft prior to coordinated disclosure. There is no confirmed in-the-wild exploitation noted in the source material, and the advisory does not appear on the CISA Known Exploited Vulnerabilities catalog yet. Treat this as pre-exploitation-window intelligence: ZDI advisories of this class historically see proof-of-concept code within weeks of publication, because link-following primitives against scheduled tasks are well-documented and highly repeatable. Defenders should operate as if a PoC will be public soon.

Detection & Response

Link-following privilege escalation is very detectable if you're looking at the right layer. The attacker must perform three observable actions: create a link object from a LOCAL SERVICE process, trigger or interact with the Compatibility Appraiser task, and cause CompatTelRunner.exe to touch an anomalous path or spawn follow-on activity. Baseline your environment first — legitimate LOCAL SERVICE processes almost never create NTFS junctions or symlinks.

Sigma Rules

---
title: LOCAL SERVICE Process Creating Symbolic Links or Junctions
id: 3f8a2c41-7b1d-4e59-a0c2-9d6e5f4b8a17
status: experimental
description: Detects processes running as LOCAL SERVICE creating NTFS junctions or symbolic links via mklink, cmd, or PowerShell — a hallmark primitive of link-following privilege escalation attacks such as ZDI-26-606 (Windows Compatibility Appraiser).
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-606/
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: process_creation
  product: windows
detection:
  selection_user:
    User|contains:
      - 'LOCAL SERVICE'
      - 'S-1-5-19'
  selection_cmd:
    CommandLine|contains:
      - 'mklink'
      - ' /j '
      - ' /d '
      - 'New-Item -ItemType SymbolicLink'
      - 'New-Item -ItemType Junction'
  condition: selection_user and selection_cmd
falsepositives:
  - Rare — legitimate LOCAL SERVICE processes almost never create links; investigate all hits
level: high
---
title: Compatibility Appraiser Anomalous Child Process or Post-Task Activity
id: 8c2e6d05-4a9f-4b31-b7c8-1e3d5f7a9b24
status: experimental
description: Detects CompatTelRunner.exe spawning child processes or command interpreters, which is abnormal for the telemetry component and may indicate successful exploitation of ZDI-26-606 link-following privilege escalation.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-606/
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\CompatTelRunner.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\schtasks.exe'
      - '\net.exe'
      - '\net1.exe'
      - '\whoami.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Extremely rare — CompatTelRunner.exe does not legitimately spawn interactive tooling
level: critical
---
title: Compatibility Appraiser Scheduled Task Manual Trigger by Service Account
id: 5b1d9e38-2c6a-4f84-a3d7-6e9c1b4f8d52
status: experimental
description: Detects manual execution of the Microsoft Compatibility Appraiser scheduled task via schtasks or Task Scheduler APIs initiated from a LOCAL SERVICE context, consistent with an attacker triggering the vulnerable component on demand rather than waiting for its scheduled run.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-606/
  - https://attack.mitre.org/techniques/T1053.005/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.privilege_escalation
  - attack.execution
  - attack.t1053.005
  - attack.t1068
logsource:
  category: process_creation
  product: windows
detection:
  selection_cmd:
    CommandLine|contains:
      - 'schtasks'
      - '/run'
      - 'Microsoft Compatibility Appraiser'
  selection_user:
    User|contains:
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
      - 'S-1-5-19'
      - 'S-1-5-20'
  condition: selection_cmd and selection_user
falsepositives:
  - Legitimate administrators manually running the task (rare, and typically not from a service account context)
level: high

KQL — Microsoft Sentinel / Defender

This query hunts the full attack chain in Defender XDR telemetry: service-account link creation, manual task triggering, and anomalous CompatTelRunner behavior. Run it as a hunting query over a 7–14 day window and consider converting the link-creation portion into a scheduled analytic rule.

// Hunt for ZDI-26-606 attack-chain behaviors: link creation from LOCAL SERVICE,
// manual Compatibility Appraiser task triggers, and anomalous CompatTelRunner children.
let ServiceAccounts = dynamic(["LOCAL SERVICE", "NETWORK SERVICE", "nt authority\\local service", "nt authority\\network service"]);
let LinkPrimitives = dynamic(["mklink", " /j ", " /d ", "SymbolicLink", "Junction"]);
union withsource=TableName (DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessAccountName has_any (ServiceAccounts)
| where ProcessCommandLine has_any (LinkPrimitives)
| project TimeGenerated, TableName, DeviceName, ActivityType="LinkCreationFromServiceAccount",
    InitiatingProcessAccountName, InitiatingProcessFileName, ProcessCommandLine, FileName, SHA256),
(DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where ProcessCommandLine has "Microsoft Compatibility Appraiser" and ProcessCommandLine has "/run"
| where InitiatingProcessAccountName has_any (ServiceAccounts)
| project TimeGenerated, TableName, DeviceName, ActivityType="ManualAppraiserTaskTrigger",
    InitiatingProcessAccountName, InitiatingProcessFileName, ProcessCommandLine, FileName, SHA256),
(DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName =~ "CompatTelRunner.exe"
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","rundll32.exe","regsvr32.exe","mshta.exe","schtasks.exe","net.exe","whoami.exe")
| project TimeGenerated, TableName, DeviceName, ActivityType="CompatTelRunnerAnomalousChild",
    InitiatingProcessAccountName, InitiatingProcessFileName, ProcessCommandLine, FileName, SHA256)
| order by TimeGenerated desc

Velociraptor VQL

Use this artifact to sweep endpoints for live evidence of the primitive: link objects under the Application Experience telemetry paths and suspicious processes executing from service-account contexts with link-creation tooling.

-- ZDI-26-606 hunt: junctions/symlinks under Application Experience telemetry paths
-- and link-creation commands executed from service contexts.
LET reparse = SELECT FullPath, Name, Mtime,
       parse_ntfs(device=FullPath).ReparsePoint.TargetName AS LinkTarget
FROM glob(globs=[
  'C:/ProgramData/Microsoft/Windows/Application Experience/**',
  'C:/Windows/Temp/**'
], accessor='ntfs')
WHERE LinkTarget

LET procs = SELECT Pid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE (Username =~ 'LOCAL SERVICE' OR Username =~ 'NETWORK SERVICE')
  AND (CommandLine =~ 'mklink|/j |SymbolicLink|Junction'
       OR CommandLine =~ 'Microsoft Compatibility Appraiser')

SELECT * FROM reparse
UNION ALL
SELECT FullPath=Exe, Name=Name, Mtime=CreateTime, LinkTarget=CommandLine FROM procs

Remediation & Verification Script

Until Microsoft's patch is applied, this script (1) inventories the Compatibility Appraiser task configuration, (2) audits for pre-existing reparse points in the telemetry paths that an attacker would target, and (3) optionally disables the scheduled task as a risk-reduction measure on high-value servers where telemetry collection is not required. Review organizational telemetry dependencies before disabling.

# ZDI-26-606 — Windows Compatibility Appraiser link-following LPE
# Audit + optional mitigation script. Run elevated. Test before broad deployment.

# 1) Verify current task state and the account context it runs under
$task = Get-ScheduledTask -TaskName "Microsoft Compatibility Appraiser" -ErrorAction SilentlyContinue
if ($task) {
    $task | Select-Object TaskName, TaskPath, State
    $task.Principal | Select-Object UserId, LogonType, RunLevel
} else {
    Write-Host "[!] Compatibility Appraiser task not found on this host."
}

# 2) Audit Application Experience telemetry paths for suspicious reparse points (junctions/symlinks)
$paths = @(
    "$env:ProgramData\Microsoft\Windows\Application Experience",
    "$env:SystemRoot\Temp",
    "$env:SystemRoot\System32\config\systemprofile\AppData\Local"
)
foreach ($p in $paths) {
    if (Test-Path $p) {
        Get-ChildItem -Path $p -Recurse -Force -ErrorAction SilentlyContinue |
            Where-Object { $_.Attributes -band [IO.FileAttributes]::ReparsePoint } |
            Select-Object FullName, LinkTarget, LastWriteTime
    }
}

# 3) Check for pending Windows security updates (the fix will ship via Patch Tuesday cumulative update)
$session = New-Object -ComObject Microsoft.Update.Session
$searcher = $session.CreateUpdateSearcher()
$pending = $searcher.Search("IsInstalled=0 and Type='Software' and IsHidden=0")
Write-Host "[*] Pending updates: $($pending.Updates.Count)"
$pending.Updates | ForEach-Object { $_.Title }

# 4) OPTIONAL mitigation — disable the Compatibility Appraiser task on high-value servers
#    where CEIP/telemetry is not required. Uncomment after change-control approval.
# Disable-ScheduledTask -TaskName "Microsoft Compatibility Appraiser" -TaskPath "\Microsoft\Windows\Application Experience\"
# Write-Host "[+] Compatibility Appraiser task disabled as interim mitigation."

# 5) Post-patch verification: confirm latest cumulative update installed
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5 HotFixID, Description, InstalledOn

Remediation

1. Patch as soon as Microsoft's update ships. ZDI-26-606 was disclosed through ZDI's coordinated process; the fix will arrive in a Microsoft cumulative update. Monitor the ZDI-26-606 advisory page for the CVE assignment and the Microsoft Security Update Guide for the corresponding KB. Apply the applicable cumulative update to all supported Windows client and server builds, prioritizing servers hosting services that run as LOCAL SERVICE or NETWORK SERVICE — IIS, SQL Server, and third-party network-facing services — because those are the hosts where a Stage-1 foothold most plausibly exists.
2. Reduce the Stage-1 attack surface. This vulnerability is only reachable after an attacker executes code as LOCAL SERVICE. That means your webshell prevention, service hardening, patch hygiene on network-facing services, and WAF coverage are the real front line. A priv-esc bug with no foothold is a non-event.
3. Interim mitigation where acceptable: On servers where Customer Experience Improvement Program / application-compatibility telemetry is not operationally required, disabling the Microsoft Compatibility Appraiser scheduled task removes the trigger mechanism. Validate telemetry dependencies first — some Windows Analytics/upgrade-readiness tooling depends on it — and document this as a temporary control, not a substitute for patching.
4. Harden link-creation primitives: Audit which principals can create symlinks. The SeCreateSymbolicLinkPrivilege right is restricted to administrators by default; verify no service accounts have been granted it. Consider attack surface reduction around mklink execution from service contexts via AppLocker or WDAC policies where feasible.
5. Deploy detection content now. Even pre-PoC, the Sigma rules and KQL above target behaviors — LOCAL SERVICE link creation, manual task triggers, CompatTelRunner child processes — that have near-zero legitimate baselines. These are durable detections for the entire class of link-following priv-esc bugs, not just this advisory.
6. Hunt retroactively. Run the KQL and VQL content across your fleet for the past 14–30 days. If you find reparse points in telemetry paths or service-account mklink executions, treat the host as potentially compromised and initiate IR: capture memory, preserve the reparse targets, and review for SYSTEM-level persistence created after the timestamp.
7. Track CISA KEV. If exploitation is confirmed in the wild, this advisory will likely land in the Known Exploited Vulnerabilities catalog with a federal remediation deadline — at which point your patch window shrinks from "next cycle" to days. Build that monitoring into your vulnerability-management workflow now.

The Bottom Line

ZDI-26-606 is a textbook second-stage privilege escalation: a SYSTEM-integrity telemetry component following attacker-controlled links. Alone, it buys an attacker nothing. Chained with any service-side foothold, it buys them the box. Your defensive priority order is: patch when the KB drops, disable the task where you can, deploy the detections today, and — most importantly — treat every LOCAL SERVICE compromise as one step away from SYSTEM on any unpatched host.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub