Microsoft Windows: Local privilege escalation in Windows Setup Files Cleanup

Summary

A local vulnerability in the Windows Setup Files Cleanup component allows the external control of a system or configuration setting. An attacker with an existing low-privileged account on the system can elevate privileges, with high impact on confidentiality, integrity and availability. No user interaction is required, but the attacker must already have local access.

Affected

• Windows 10 Version 1607: 10.0.14393.0 to < 10.0.14393.9612
• Windows 10 Version 1809: 10.0.17763.0 to < 10.0.17763.9376
• Windows 10 Version 21H2: 10.0.19044.0 to < 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.0 to < 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.0 to < 10.0.22631.7652
• Windows 11 Version 24H2: 10.0.26100.0 to < 10.0.26100.9711
• Windows 11 Version 25H2: 10.0.26200.0 to < 10.0.26200.9711
• Windows 11 Version 26H1: 10.0.28000.0 to < 10.0.28000.3231
• Windows 11 Version 26H2: 10.0.26300.0 to < 10.0.26300.9711
• Windows Server 2012 (including Server Core): 6.2.9200.0 to < 6.2.9200.26434
• Windows Server 2012 R2 (including Server Core): 6.3.9600.0 to < 6.3.9600.23470
• Windows Server 2016: 10.0.14393.0 to < 10.0.14393.9612

Fixed in

• Windows 10 Version 1607 and Windows Server 2016: 10.0.14393.9612
• Windows 10 Version 1809: 10.0.17763.9376
• Windows 10 Version 21H2: 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.7652
• Windows 11 Version 24H2 and 25H2, Version 26H2: 10.0.26100.9711 (24H2), 10.0.26200.9711 (25H2), 10.0.26300.9711 (26H2)
• Windows 11 Version 26H1: 10.0.28000.3231
• Windows Server 2012: 6.2.9200.26434
• Windows Server 2012 R2: 6.3.9600.23470
• Security update from Microsoft in the October 2026 cumulative update. Verify the exact build numbers in the Microsoft Security Update Guide before deployment.

Workaround

Unknown. Microsoft has not published a workaround. Installing the security update is the recommended fix.

Exploitation

• Not listed in CISA KEV.
• CISA SSVC data: exploitation none, automatable no, technical impact total.
• EPSS score about 0.4 percent.
• No public proof of concept was found at the time of writing.

Our recommendation

• Deploy the October 2026 cumulative update to all affected systems, including servers.
• Identify Windows 10 Version 1607 devices first. Check the Microsoft lifecycle page to confirm whether they still receive updates; if not, plan an upgrade or isolation.
• Prioritise shared PCs, kiosks, point-of-sale systems and servers running Windows Server 2016 or 2012.
• Limit local accounts and review who has a logon on affected systems.
• Monitor for unusual privilege changes or new SYSTEM-level processes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-73027 msrc.microsoft.com
• OpenCVE: CVE-2026-73027 app.opencve.io
• Vulners NVD record: CVE-2026-73027 vulners.com
• Vulners CVE list record: CVE-2026-73027 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 03:46.