New Windows RPC Flaw Enables SYSTEM Privilege Escalation

Microsoft Windows is facing renewed security concerns following the disclosure of a critical architectural vulnerability in its Remote Procedure Call (RPC) mechanism, dubbed PhantomRPC. The flaw, revealed by a security researcher from Kaspersky at the Black Hat Asia 2026 conference, allows attackers with low-level access to escalate privileges to SYSTEM or Administrator levels across virtually all Windows versions. Unlike traditional vulnerabilities, PhantomRPC does not rely on coding errors or memory corruption but instead exploits a fundamental design weakness in how Windows handles RPC connections.

At the core of the issue is the way the Windows RPC runtime (rpcrt4.dll) manages communication with services that are offline or disabled. When a privileged process attempts to connect to such a service, the system does not properly verify the authenticity of the responding server. This gap allows an attacker to set up a malicious RPC server that impersonates a legitimate service. By leveraging the RpcImpersonateClient API, the attacker can assume the identity of a higher-privileged process, effectively jumping from a low-privileged account—such as Network Service—to full SYSTEM access.

Researchers demonstrated multiple real-world attack scenarios that make exploitation both practical and dangerous. In some cases, simple actions like running system utilities or launching applications can trigger privileged RPC calls. For example, system processes tied to Group Policy updates, browser startup, or background diagnostics can unknowingly connect to a spoofed RPC endpoint. In other scenarios, attackers can exploit routine system behavior, requiring no user interaction at all, making detection even more challenging.