# Privileged process reachable via token or desktop

Protected or elevated process whose token, desktop, or caller cache still lets a lower-privileged party act on it

_Area: Memory corruption and native code. Seen in 2 disclosed reports; latest 2026-02-12. Updated 2026-11-08._

## How it works
A protection boundary is placed on the process object but not on the things that grant control of it. The assumption "protected/elevated process = unreachable" breaks because the caller's own token, a cached caller identity, or a shared desktop still lets a lower-privileged party act on the privileged process. The privileged side elevates integrity or runs as SYSTEM while keeping the caller's token, or validates callers by reusable identifiers, or leaves the token object unprotected [E1](https://bugbountylibrary.com/r/blog%3Aprojectzero-google-2026-02-windows-administrator-protection-html.md)[E2](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-zscaler-client-connector-local-privilege-escalation.md)[E3](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-sandboxing-antimalware-products.md).

## Where it shows up
- Broker elevates integrity but keeps the caller's limited-user token, so the process shares desktop/profile with admin processes [E1](https://bugbountylibrary.com/r/blog%3Aprojectzero-google-2026-02-windows-administrator-protection-html.md)
- UI Access / uiAccess-signed executables, window hooks, and RPC parameters like DEBUG_PROCESS or escalation flags in the launch path [E1](https://bugbountylibrary.com/r/blog%3Aprojectzero-google-2026-02-windows-administrator-protection-html.md)
- Caller-validation caches keyed by PID or other reusable identifiers that are never pruned [E2](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-zscaler-client-connector-local-privilege-escalation.md)
- RPC handlers that skip type checks (password type) or pass caller strings into paths unsanitized [E2](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-zscaler-client-connector-local-privilege-escalation.md)
- Protection that blocks PROCESS_TERMINATE but leaves OpenProcessToken/token DACL open to SYSTEM [E3](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-sandboxing-antimalware-products.md)

## How to review
For each privileged process, enumerate every securable object that yields control: its token (DACL, privileges, integrity/trust label), its desktop, its launch/RPC parameters, and any cache of trusted callers. The invariant: no lower-privileged principal may obtain a handle or message path that changes the privileged process's token, integrity, code, or memory. Check that caller validation is by unforgeable identity, not by PID or process context; that caches are pruned and cannot collide; that every RPC parameter is type- and path-validated; and that a process keeping the caller's token does not also get elevated integrity or shared desktop [E1](https://bugbountylibrary.com/r/blog%3Aprojectzero-google-2026-02-windows-administrator-protection-html.md)[E2](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-zscaler-client-connector-local-privilege-escalation.md)[E3](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-sandboxing-antimalware-products.md).

## How finders spotted it
- Reasoned about UIPI/UI Access design and noticed UI Access processes run under the limited user but at High integrity, breaking profile separation; then audited secure-directory checks, reverse-engineered signed uiAccess executables, and inspected RPC launch parameters [E1](https://bugbountylibrary.com/r/blog%3Aprojectzero-google-2026-02-windows-administrator-protection-html.md)
- Re-reviewed an RPC design after an earlier CVE, noticed the FNV-1a PID-keyed cache is never pruned, hypothesized PID reuse collision, then audited the revert handler for missing checks [E2](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-zscaler-client-connector-local-privilege-escalation.md)
- Noted PPL blocks PROCESS_TERMINATE but not token access, saw an MSDN discrepancy on OpenProcessToken rights, and inspected the token DACL showing SYSTEM full control [E3](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-sandboxing-antimalware-products.md)

## Variants seen
- Elevated-integrity process retaining caller token, reachable via window hooks [E1](https://bugbountylibrary.com/r/blog%3Aprojectzero-google-2026-02-windows-administrator-protection-html.md)
- PID-cache collision plus type confusion and path traversal in an RPC service [E2](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-zscaler-client-connector-local-privilege-escalation.md)
- Protected process whose token object lacks protection [E3](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-sandboxing-antimalware-products.md)

## Impact and severity
Silent compromise of admin processes and shadow-administrator reach [E1](https://bugbountylibrary.com/r/blog%3Aprojectzero-google-2026-02-windows-administrator-protection-html.md); SYSTEM-level code execution from a standard user [E2](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-zscaler-client-connector-local-privilege-escalation.md); Defender disabled by stripping token privileges [E3](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-sandboxing-antimalware-products.md). Impact rises when low-severity bugs chain (cache collision + type confusion + traversal + DLL hijack) [E2](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-zscaler-client-connector-local-privilege-escalation.md). Note E3 is SYSTEM-to-PPL, not lower-privileged to higher, so it widens the pattern rather than fitting it exactly.

## Seen in real software
Open-source packages and projects, and products, where this pattern was found. If the target runs one, compare the version it runs with the fix.
- **Zscaler Client Connector** (ZSATrayManager RPC caller validation and PERFORM_APP_REVERT ) fixed in 4.2.0.209 / 4.3.0.121: Cache Me If You Can: Local Privilege Escalation in Zscaler Client Connector (CVE-2023-41973) (CVE-2023-41973, CVE-2023-41972). Report: https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-zscaler-client-connector-local-privilege-escalation.md

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aprojectzero-google-2026-02-windows-administrator-protection-html.md
- E2: https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-zscaler-client-connector-local-privilege-escalation.md
- E3: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-sandboxing-antimalware-products.md