Windows Setup Files Cleanup: Privilege escalation via TOCTOU race condition

Summary

A time-of-check time-of-use (TOCTOU) race condition in the Windows Setup Files Cleanup component allows a local user with low privileges to elevate their privileges to a higher level. An attacker needs to already run code on the system, for example through phishing, malware or a compromised account. Microsoft rates the impact as high for confidentiality, integrity and availability, and the attack complexity as high.

Affected

• Windows 10 Version 1607 (x86 and x64) before 10.0.14393.9612
• Windows Server 2016 (including Server Core) before 10.0.14393.9612
• Windows 10 Version 1809 and Windows Server 2019 (including Server Core) before 10.0.17763.9376
• Windows 10 Version 21H2 before 10.0.19044.7807
• Windows 10 Version 22H2 before 10.0.19045.7807
• Windows 11 Version 23H2 before 10.0.22631.7652
• Windows 11 Version 24H2 and 25H2 before 10.0.26100.9711 and 10.0.26200.9711
• Windows 11 Version 26H1 before 10.0.28000.3231
• Windows 11 Version 26H2 before 10.0.26300.9711
• Windows Server 2022 before 10.0.20348.5761

Fixed in

• Windows 10 1607 and Windows Server 2016: build 10.0.14393.9612, delivered in KB5126868
• Other affected versions: see the Microsoft Security Update Guide for the fixed build per version
• Released on October 13, 2026 (Patch Tuesday)

Workaround

• No vendor workaround is documented. Installing the security update is the fix.
• Third-party advice (not from Microsoft, not verified): monitor event logs for unexpected Setup Files Cleanup activity and enforce least privilege on local accounts.

Exploitation

• Microsoft: not publicly disclosed, not exploited, assessed as "Exploitation More Likely".
• No public proof of concept identified.
• Conflicting data: a Tenable plugin for KB5126868 reports an exploit as available and a CISA KEV due date. This may apply to the whole bulletin rather than this CVE. Unconfirmed.
• Check the CISA KEV catalog directly for CVE-2026-83505.

Our recommendation

• Install KB5126868 or the matching fixed build on all remaining Windows 10 1607 and Server 2016 systems as a priority, starting with multi-user systems, terminal servers and shared PCs.
• Verify whether Windows 10 1607 is still supported and receives security updates. If it is end of life, plan an upgrade.
• Check the CISA KEV catalog for this CVE and raise the priority if it is listed.
• Monitor for unexpected privilege changes on local accounts.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-83505 msrc.microsoft.com
• Vulners: CVE-2026-83505 (CNA data) vulners.com
• OpenCVE: CVE-2026-83505 app.opencve.io
• Tenable plugin for KB5126868 www.tenable.com
• Senserva: KB5126868 release details senserva.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 08:46.