CVE-2026-48581: Microsoft Surface Go 2 1901 Firmware

High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days.

Insufficient granularity of access control in Microsoft Surface allows an authorized attacker to elevate privileges locally.

Affected products

Microsoft Surface Go 2 1901 Firmware: affected versions not specified
Microsoft Surface Go 2 1926 Firmware: affected versions not specified
Microsoft Surface Go 2 1927 Firmware: affected versions not specified
Microsoft Surface Go 3 1901 Firmware: affected versions not specified
Microsoft Surface Go 3 1926 Firmware: affected versions not specified
Microsoft Surface Go 3 2022 Firmware: affected versions not specified
Microsoft Surface Hub 2s 85 Firmware: affected versions not specified
Microsoft Surface Hub 2s Firmware: affected versions not specified
Microsoft Surface Hub 3 50 Firmware: affected versions not specified
Microsoft Surface Hub 3 85 Firmware: affected versions not specified
Microsoft Surface Hub Firmware: affected versions not specified
Microsoft Surface Laptop 4 1950 Firmware: affected versions not specified
Microsoft Surface Laptop 4 1951 Firmware: affected versions not specified
Microsoft Surface Laptop 4 1952 Firmware: affected versions not specified
Microsoft Surface Laptop 4 1953 Firmware: affected versions not specified
Microsoft Surface Laptop 4 1958 Firmware: affected versions not specified
Microsoft Surface Laptop 4 1959 Firmware: affected versions not specified
Microsoft Surface Laptop 4 1978 Firmware: affected versions not specified
Microsoft Surface Laptop 4 1979 Firmware: affected versions not specified
Microsoft Surface Laptop Go 1943 Firmware: affected versions not specified
Microsoft Surface Laptop Go 2 2013 Firmware: affected versions not specified
Microsoft Surface Laptop Go 3 2013 Firmware: affected versions not specified
Microsoft Surface Pro 7+ 1960 Firmware: affected versions not specified
Microsoft Surface Pro 7+ With Lte Advanced 1961 Firmware: affected versions not specified
Microsoft Surface Pro 8 1983 Firmware: affected versions not specified
and 2 more

Published 2026-07-14. Last modified 2026-07-24.