Windows Server Update Service: Local privilege escalation via incorrect default permissions
Summary
Incorrect default permissions in Windows Server Update Service (WSUS) allow an authorized local attacker to elevate privileges. The attacker needs a local, low-privileged account on the WSUS server, and exploitation requires a user-interaction step and is rated high complexity. The CVSS 3.1 score is 7.5 (High), with high impact on confidentiality, integrity and availability and a scope change.
Affected
- Windows Server 2012 (incl. Server Core): 6.2.9200.0 to before 6.2.9200.26434
- Windows Server 2012 R2 (incl. Server Core): 6.3.9600.0 to before 6.3.9600.23470
- Windows Server 2016 (incl. Server Core): 10.0.14393.0 to before 10.0.14393.9612
- Windows Server 2019 (incl. Server Core): 10.0.17763.0 to before 10.0.17763.9376
- Windows Server 2022: 10.0.20348.0 to before 10.0.20348.5761
- Windows Server 2025 (incl. Server Core): 10.0.26100.0 to before 10.0.26100.33650
Fixed in
- Server 2016: KB5126868 (OS Build 14393.9612)
- Server 2022: KB5126655 (OS Build 20348.5761)
- Server 2025: KB5126646 (OS Build 26100.33650)
- Server 2012, 2012 R2 and 2019: fixed builds per the CNA record; the KB numbers are not confirmed by the sources, so check the MSRC page
Workaround
- No workaround documented. Unknown.
Exploitation
- No confirmed exploitation in the wild found.
- No public proof of concept found.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- EPSS about 0.003 (low predicted exploitation probability).
Our recommendation
- Patch WSUS servers with the fixed builds listed above, starting with Server 2012 hosts, which are out of mainstream support.
- Until patched, limit local logon on WSUS servers to administrators and review permissions on WSUS directories and services.
- Check whether WSUS is in use and which Windows Server version runs it.
- Monitor for unexpected local logons and privilege changes on WSUS servers.
Information from Microsoft (Patch Tuesday October 2026)
- Severity (Microsoft)
- Important
- Impact
- Elevation of privilege – Windows Server Update Service
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5126835, KB5126836, KB5126868, KB5126651, KB5126655, KB5126646
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Response Center advisory CVE-2026-105009 msrc.microsoft.com
- vulners NVD record CVE-2026-105009 vulners.com
- vulners CVE List record CVE-2026-105009 vulners.com
- Microsoft 2026 CVE customer-risk cohort document cdn-dynmedia-1.microsoft.com
- VulDB entry 418067 vuldb.com
- threatint CVE-2026-105009 cve.threatint.com
- vulners EUVD-2026-100398 (KB listings) vulners.com
- strix.ai CVE-2026-105009 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 19:37.
Original description (NVD)
Incorrect default permissions in Windows Server Update Service allows an authorized attacker to elevate privileges locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.