Windows Shell: Relative path traversal allows local privilege escalation
Summary
A relative path traversal flaw (CWE-23) in Windows Shell allows an attacker with a local account to elevate privileges, potentially to SYSTEM level. No user interaction is required. Exploitation requires prior local access, so the main risk is on shared systems, terminal servers and endpoints that have had malware or phishing incidents.
Affected
- Windows 10 Version 1607 (builds below 10.0.14393.9612)
- Windows 10 Version 1809 (builds below 10.0.17763.9376)
- Windows 10 Version 21H2 (builds below 10.0.19044.7807)
- Windows 10 Version 22H2 (builds below 10.0.19045.7807)
- Windows 11 Versions 23H2, 24H2, 25H2, 26H1 and 26H2 (builds per CNA record)
- Windows Server 2012 and 2012 R2, including Server Core (builds per CNA record)
- Windows Server 2016 (builds below 10.0.14393.9612)
Some mirrors list conflicting builds. Unknown until checked against MSRC.
Fixed in
- Windows 10 1607: 10.0.14393.9612 (per CNA record; KB number unknown)
- Windows 10 1809: 10.0.17763.9376
- Windows 10 21H2: 10.0.19044.7807
- Windows 10 22H2: 10.0.19045.7807 (one mirror conflicts)
- Windows 11 and Windows Server: builds per CNA record; verify on MSRC
Workaround
Unknown.
Exploitation
- No exploitation in the wild and no public proof of concept known.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- EPSS below 1%.
Our recommendation
- Install the October 2026 security updates on all affected systems, starting with Windows 10 1607 and 1809, Server 2016 and 2019, and multi-user systems.
- Confirm the exact fixed build and KB numbers on the MSRC advisory before rollout.
- Check whether any Windows 10 1607 systems are still in use and whether they still receive security updates.
- Limit local logons on shared and terminal systems and monitor for unusual privilege escalation.
Information from Microsoft (Patch Tuesday October 2026)
- Severity (Microsoft)
- Important
- Impact
- Elevation of privilege – Windows Shell
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5126651, KB5126655, KB5126657, KB5126646, KB5127648, KB5126653
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MSRC Security Update Guide (not directly accessed) msrc.microsoft.com
- Vulners CNA JSON (CVELIST) vulners.com
- OpenCVE app.opencve.io
- Vulners NVD mirror vulners.com
- Vulners MSCVE mirror vulners.com
- Rapid7 via Vulners vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 03:58.
Original description (NVD)
Relative path traversal in Windows Shell allows an authorized attacker to elevate privileges locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.