Researchers have discovered a critical elevation-of-privilege vulnerability in Windows Plug and Play that allows attackers to gain SYSTEM-level access on fully patched Windows 11 machines. The flaw exploits the automatic driver installation mechanism built into Windows to fetch signed vendor software for emulated USB devices, then chains that process to execute privileged installation components with elevated permissions.
The attack chain works by manipulating Plug and Play to recognize a spoofed USB device, triggering automatic retrieval of legitimate vendor drivers from Microsoft's servers. Attackers then leverage this process to execute code with SYSTEM privileges. Notably, the exploit does not require physical hardware access. Researchers demonstrated that attackers can trigger the same vulnerability over Remote Desktop Protocol when Plug and Play or low-level USB redirection is enabled on the target system, significantly expanding the attack surface.
This vulnerability affects fully updated Windows 11 installations, meaning current security patches do not prevent exploitation. The technical sophistication lies in weaponizing a standard Windows feature designed for user convenience into a reliable privilege escalation vector. By abusing the trust Windows places in vendor-signed drivers and the PnP subsystem's automatic installation routines, attackers bypass multiple security boundaries with minimal user interaction.
Organizations running Windows 11 should prioritize identifying systems with Remote Desktop enabled and Plug and Play redirection active, particularly in environments where sensitive work occurs. The exposure is especially acute for remote workers and organizations using virtual desktop infrastructure where USB redirection is commonly enabled for device compatibility.
Microsoft has not yet disclosed whether a patch exists for this vulnerability. Until remediation is available, organizations should evaluate disabling USB redirection in RDP sessions where feasible and restrict Plug and Play functionality through Group Policy on high-value systems. The research demonstrates that even mature operating systems can harbor exploitable weaknesses in longstanding subsystems that receive less security scrutiny than newer attack surfaces.