Windows Distributed File System: Privilege escalation via untrusted pointer dereference

Summary

A flaw in the Windows Distributed File System (DFS) allows an untrusted pointer dereference that enables an attacker to elevate privileges over the network. According to the CVE record, no privileges and no user interaction are required, so a reachable DFS service can be abused remotely. The record lists several Windows 10, Windows 11 and Windows Server releases as affected, including Windows 10 Version 1607 and Windows Server 2016. Some third-party sources list a lower CVSS score (7.5) than the 9.8 in the CVE data, so the score should be verified against the MSRC advisory.

Affected

• Windows 10 Version 1607 (10.0.14393.0 before 10.0.14393.9612) - Windows Server 2016 (10.0.14393.0 before 10.0.14393.9612) - Other Windows 10, Windows 11 and Windows Server releases listed in the MSRC advisory

Fixed in

• Windows 10 Version 1607 and Windows Server 2016: build 10.0.14393.9612 or later, per the CVE record. - Confirm the fix and support status for Windows 10 Version 1607 in the MSRC advisory.

Workaround

Unknown. No workaround is described in the sources. If patching is delayed, restrict SMB and DFS access to file servers to trusted hosts.

Exploitation

• No known exploitation in the sources. - CISA SSVC assessment: exploitation none, automatable yes, technical impact total. - Not found in the Known Exploited Vulnerabilities list that was checked. - EPSS score 0.01149 (low). - Positive Technologies describes it as remote privilege escalation (PT-2026-121122).

Our recommendation

• Identify systems with the DFS role and hosts running Windows 10 Version 1607, 1809 or Windows Server 2012/2016. - Apply the Microsoft security update for each affected system as soon as the fix for your edition is confirmed. - Limit SMB and DFS access to trusted internal hosts and do not expose file services to the internet. - Monitor for exploitation and recheck the CVSS score and status on NVD and MSRC.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-105723 msrc.microsoft.com
• Vulners: NVD record CVE-2026-105723 vulners.com
• Vulners: Microsoft MSCVE MS:CVE-2026-105723 vulners.com
• Vulners: Positive Technologies PT-2026-121122 vulners.com
• Vulners: VulnRichment CVE-2026-105723 vulners.com
• Strix: CVE-2026-105723 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 18:54.