Windows 10: Local privilege escalation via link following in Windows Backup Engine
Summary
The Windows Backup Engine in Windows 10 Version 21H2 contains an improper link resolution flaw before file access (CWE-59, 'link following'). An authorized local user with a low-privileged account can exploit it to elevate privileges on the affected machine. Exploitation requires local access and a high attack complexity; the flaw is not reachable from the internet.
Affected
- Windows 10 Version 21H2 (build 10.0.19044.0 to before 10.0.19044.7807)
Fixed in
- Windows 10 Version 21H2: build 10.0.19044.7807 or later (KB5126657, cumulative Extended Security Update released October 13, 2026, according to third-party coverage; verify on the Microsoft Update Guide)
Workaround
Unknown. No workaround is documented in the sources reviewed; patching is the documented remedy.
Exploitation
- CVSS 3.1 vector: AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (base score 7.0, High)
- Microsoft exploitability field E:U: no exploit known to exist
- CISA SSVC: exploitation none, automatable no, technical impact total
- No CISA KEV listing and no public proof-of-concept found in the sources reviewed
- EPSS score 0.27% at time of review
Our recommendation
- Identify Windows 10 Version 21H2 systems and confirm their ESU enrolment or plan an upgrade to a supported Windows version.
- Install build 10.0.19044.7807 or later through the normal monthly update cycle; prioritize shared or multi-user machines and devices with many local accounts.
- Limit local interactive logons and review which accounts hold backup-related rights.
- Monitor for signs of local privilege escalation on affected endpoints.
Information from Microsoft (Patch Tuesday October 2026)
- Severity (Microsoft)
- Important
- Impact
- Elevation of privilege – Windows Backup Engine
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5126657, KB5126653, KB5127648, KB5127646
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-108135 msrc.microsoft.com
- Vulners CVE list entry (CNA data) vulners.com
- Threatint CVE record cve.threatint.com
- CtrlAltNod: KB5126657 update notes www.ctrlaltnod.com
- Neowin: KB5126657 Patch Tuesday update www.neowin.net
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 09:45.
Original description (NVD)
Improper link resolution before file access ('link following') in Windows Backup Engine allows an authorized attacker to elevate privileges locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.