Microsoft Windows Server Update Service: Elevation of privilege

Summary

A flaw in the access control of Windows Server Update Service (WSUS) allows an attacker with a valid local, low-privilege account to gain higher privileges on the system. The attacker needs local access first, for example through phishing or malware running as a standard user; the flaw cannot be used remotely. Microsoft has released security updates for the affected Windows client and server versions, and the CNA record lists a wider range of versions than the CPE in the record.

Affected

• Microsoft Windows 10 Version 1607 and 1809 (10.0.14393.0 to < 10.0.14393.9612; 10.0.17763.0 to < 10.0.17763.9376)
• Windows Server 2012 and 2012 R2, including Server Core (6.2.9200.0 to < 6.2.9200.26434; 6.3.9600.0 to < 6.3.9600.23470)
• Windows Server 2016, 2019 and 2025, including Server Core (10.0.14393.0 to < 10.0.14393.9612; 10.0.17763.0 to < 10.0.17763.9376; 10.0.26100.0 to < 10.0.26100.33650)
• Windows Server 2022 (10.0.20348.0 to < 10.0.20348.5761)
• The CPE in the record lists only Windows 10 1607.

Fixed in

• Microsoft Security Updates for the affected versions above. Fixed builds per CNA record: 10.0.14393.9612, 10.0.17763.9376, 6.2.9200.26434, 6.3.9600.23470, 10.0.20348.5761 and 10.0.26100.33650.
• Build numbers from secondary sources are unconfirmed; verify them in the MSRC Security Update Guide and the matching KB articles before rollout.

Workaround

• Microsoft documents no workaround; applying the security update is the remedy.
• Supplementary hardening (not from Microsoft): enforce least privilege for local accounts and do not run the WSUS service with elevated privileges.

Exploitation

• MSRC: not publicly disclosed, not exploited, exploitability assessment 'Exploitation Less Likely'.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• EPSS about 0.003.
• A broker-market price estimate on VulDB is not evidence of exploitation.
• No public proof of concept known.

Our recommendation

• Patch WSUS servers and other update infrastructure first, then domain controllers, file and RDP servers, and remaining clients.
• Inventory all Windows 10 and Windows Server 2012 to 2025 systems and check their support status.
• Review local accounts and who holds standard logons on affected systems.
• Monitor for unexpected privilege changes and new local administrators.
• Treat patching as the main measure; hardening only supplements it.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide msrc.microsoft.com
• MSRC Security Update Guide (en-US) msrc.microsoft.com
• NVD via Vulners vulners.com
• CNA JSON via Vulners vulners.com
• VulDB vuldb.com
• OpenCVE app.opencve.io
• Vulners MSCVE vulners.com
• Strix CVE record www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 03:45.