Windows: Elevation of privilege in Windows Credential Providers

Summary

A race condition in the Windows Credential Providers component allows an authorized local user to elevate privileges. The attacker needs a valid local account and must win a timing-dependent race (high attack complexity), so this is a local escalation step rather than a remote entry point. A successful attack can give full control of the affected system, so the flaw is most relevant on shared workstations, terminal servers and systems where untrusted users or malware may gain local access.

Affected

• Windows 10 Version 1607 (builds 10.0.14393.0 to before 10.0.14393.9612)
• Windows 10 Version 1809 (builds before 10.0.17763.9376)
• Windows 10 Version 21H2 (builds before 10.0.19044.7807)
• Windows 10 Version 22H2 (builds before 10.0.19045.7807)
• Windows 11 Version 23H2 (builds before 10.0.22631.7652)
• Windows 11 Version 24H2 (builds before 10.0.26100.9711)
• Windows 11 Version 25H2 (builds before 10.0.26200.9711)
• Windows 11 Version 26H1 (builds before 10.0.28000.3231)
• Windows 11 Version 26H2 (builds before 10.0.26300.9711)
• Windows Server 2012 and Server Core installation (builds before 6.2.9200.26434)
• Windows Server 2012 R2 and Server Core installation (builds before 6.3.9600.23470)
• Windows Server 2016 (builds before 10.0.14393.9612)

Fixed in

• Windows 10 Version 1607: build 10.0.14393.9612 (KB number unknown)
• Windows 10 Version 1809: build 10.0.17763.9376 or later
• Windows 10 Version 21H2 and 22H2: build 10.0.19044.7807 or 10.0.19045.7807 or later
• Windows 11 23H2: build 10.0.22631.7652 or later
• Windows 11 24H2, 25H2 and 26H2: build 10.0.26100.9711, 10.0.26200.9711 or 10.0.26300.9711 or later
• Windows 11 26H1: build 10.0.28000.3231 or later
• Windows Server 2012 and 2012 R2: builds 6.2.9200.26434 and 6.3.9600.23470 or later
• Windows Server 2016: build 10.0.14393.9612 or later

The October 2026 monthly updates KB5126835 and KB5126836 are listed as related, but the mapping to versions is unknown. Verify on the MSRC Security Update Guide.

Workaround

Unknown.

Exploitation

• No evidence of exploitation in the wild found.
• CISA SSVC assessment: exploitation none, automatable no, technical impact total.
• No public proof of concept found; this means nothing is known, not that none exists.
• EPSS score 0.00193 (low predicted exploitation probability).

Our recommendation

• Install the October 2026 security update for each affected Windows version as soon as possible, prioritising shared workstations, terminal and RDP servers.
• Verify the exact update for Windows 10 Version 1607 on the MSRC page or the Microsoft Update Catalog, because the KB number is not confirmed here.
• Check whether any Windows 10 Version 1607 systems remain; this version is out of mainstream support, and systems without security updates should be upgraded or isolated.
• Review local accounts and limit who has a local logon on servers and shared systems.
• Monitor for unusual privilege changes or new local administrator accounts.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-103568 msrc.microsoft.com
• Vulners: CNA data (CVELIST) CVE-2026-103568 vulners.com
• Vulners: NVD mirror CVE-2026-103568 vulners.com
• ThreatInt: CVE-2026-103568 (CVSS, CWE, exploit maturity) cve.threatint.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 05:07.