Microsoft Windows: Improper privilege management in Group Policy
Summary
A flaw in the Windows Group Policy component allows an already authorized local user to elevate their privileges. The CNA classifies it as improper privilege management (CWE-862) with a CVSS 3.1 base score of 7.8. Exploitation requires local access with low privileges, and no user interaction is needed.
Affected
- Windows 10 Version 1607 (10.0.14393.0 to < 10.0.14393.9612)
- Windows 10 Version 1809 (10.0.17763.0 to < 10.0.17763.9376)
- Windows 10 Version 21H2 (10.0.19044.0 to < 10.0.19044.7807)
- Windows 10 Version 22H2 (10.0.19045.0 to < 10.0.19045.7807)
- Windows 11 Version 23H2 (10.0.22631.0 to < 10.0.22631.7652)
- Windows 11 Version 24H2 (10.0.26100.0 to < 10.0.26100.9711)
- Windows 11 Version 25H2 (10.0.26200.0 to < 10.0.26200.9711)
- Windows 11 Version 26H1 (10.0.28000.0 to < 10.0.28000.3231)
- Windows 11 Version 26H2 (10.0.26300.0 to < 10.0.26300.9711)
- Windows Server 2012 R2 (6.3.9600.0 to < 6.3.9600.23470), including Server Core
- Windows Server 2016 (10.0.14393.0 to < 10.0.14393.9612), including Server Core
- Windows Server 2019 (10.0.17763.0 to < 10.0.17763.9376)
Fixed in
- Windows 10 1607 and Server 2016: build 14393.9612 (October 2026 update, KB5126868)
- Windows 10 1809 and Server 2019: build 17763.9376
- Windows 10 21H2: build 19044.7807
- Windows 10 22H2: build 19045.7807
- Windows 11 23H2: build 22631.7652
- Windows 11 24H2 and 26H2: builds 26100.9711 and 26300.9711
- Windows 11 25H2: build 26200.9711
- Windows 11 26H1: build 28000.3231
- Windows Server 2012 R2: build 6.3.9600.23470
Workaround
Unknown.
Exploitation
- CISA SSVC assessment: exploitation none, not automatable, total technical impact.
- No public proof of concept found at the time of writing.
- Sources disagree on exploitation status; monitor for changes.
Our recommendation
- Install the October 2026 Windows security updates on all affected systems, prioritizing servers and administrative workstations.
- Review the Microsoft release notes for known issues before deploying to Windows 10 1607 and Server 2016.
- Limit local logon rights and restrict who can access domain-joined systems.
- Monitor for unusual privilege changes and new local administrator accounts.
Information from Microsoft (Patch Tuesday October 2026)
- Severity (Microsoft)
- Important
- Impact
- Elevation of privilege – Windows Group Policy
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5126836, KB5126868, KB5126651, KB5126657, KB5126655, KB5126653
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-100217 msrc.microsoft.com
- Microsoft release health: Windows 10 1607 and Windows Server 2016 learn.microsoft.com
- Microsoft release notes: October 2026 msrc.microsoft.com
- NVD record CVE-2026-100217 (mirror) vulners.com
- CVE list record CVE-2026-100217 (mirror) vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 05:18.
Original description (NVD)
Improper privilege management in Windows Group Policy allows an authorized attacker to elevate privileges locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.