Windows WebDAV: Heap-based buffer overflow enables privilege escalation

Summary

A heap-based buffer overflow in the WebDAV component of Microsoft Windows allows an unauthorized attacker to elevate privileges. The NVD description says the attack is possible over a network. Systems with the WebDAV service enabled are affected. Sources disagree on the attacker model and the CVSS score, so the network-reachable, unauthenticated case should be treated as the worst case until Microsoft confirms the details.

Affected

• Windows 10 Version 1607 (10.0.14393.0 to before 10.0.14393.9612)
• Windows 10 Version 1809 (10.0.17763.0 to before 10.0.17763.9376)
• Windows 10 Version 21H2 (10.0.19044.0 to before 10.0.19044.7807)
• Windows 10 Version 22H2 (10.0.19045.0 to before 10.0.19045.7807)
• Windows 11 Version 23H2 (10.0.22631.0 to before 10.0.22631.7652)
• Windows 11 Version 24H2 (10.0.26100.0 to before 10.0.26100.9711)
• Windows 11 Version 25H2 (10.0.26200.0 to before 10.0.26200.9711)
• Windows 11 Version 26H1 (10.0.28000.0 to before 10.0.28000.3231)
• Windows 11 Version 26H2 (10.0.26300.0 to before 10.0.26300.9711)
• Windows Server 2012 incl. Server Core (6.2.9200.0 to before 6.2.9200.26434)
• Windows Server 2012 R2 incl. Server Core (6.3.9600.0 to before 6.3.9600.23470)
• Windows Server 2016 (10.0.14393.0 to before 10.0.14393.9612)

Fixed in

• Windows 10 1607 and Server 2016: 10.0.14393.9612
• Windows 10 1809: 10.0.17763.9376
• Windows 10 21H2: 10.0.19044.7807
• Windows 10 22H2: 10.0.19045.7807
• Windows 11 23H2: 10.0.22631.7652
• Windows 11 24H2, 25H2 and 26H2: 10.0.26100.9711 / 10.0.26200.9711 / 10.0.26300.9711
• Windows 11 26H1: 10.0.28000.3231
• Windows Server 2012: 6.2.9200.26434
• Windows Server 2012 R2: 6.3.9600.23470
• Update number for Windows 10 1607 (reported, not verified on MSRC): KB5126868. Confirm the exact update for each branch on MSRC.

Workaround

Unknown. Microsoft has not documented a workaround in the sources reviewed.

• Disabling or removing WebDAV where it is not needed reduces exposure. This is a general recommendation, not a vendor-confirmed mitigation.
• Blocking inbound HTTP/HTTPS traffic to WebDAV endpoints at the perimeter is an interim measure.

Exploitation

• No confirmed exploitation in the wild found.
• Not listed in the CISA KEV catalog according to the sources reviewed.
• CISA SSVC: exploitation none, not automatable, total technical impact.
• No public proof of concept found.
• One third-party page shows an exploit-available flag for a related update page; it is unclear whether this applies to this CVE.

Our recommendation

• Inventory all Windows systems and check whether WebDAV is enabled and reachable from outside the network.
• Install the October 2026 cumulative update for each affected branch after confirming the exact update on MSRC.
• Disable WebDAV where it is not used and restrict access where it is needed.
• Windows 10 1607 is an older build: plan an upgrade or confirm Extended Security Update coverage.
• Monitor the CISA KEV catalog and the Microsoft advisory for changes in exploitation status.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Response Center: CVE-2026-70262 msrc.microsoft.com
• NVD record via Vulners vulners.com
• OpenCVE: CVE-2026-70262 app.opencve.io
• Strix: CVE-2026-70262 www.strix.ai
• Tenable plugin 365471 (Windows 10 1607 / Server 2016) www.tenable.com
• VulDB: CVE-2026-70262 vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 18:44.