Microsoft Windows Servicing Stack Updates: Elevation of privilege via untrusted search path

Summary

A flaw in the Servicing Stack Updates (SSU) component of multiple Windows 10, Windows 11 and Windows Server versions allows an authorized local user to gain elevated privileges. The attack requires local access and low privileges, and no user interaction is needed. An attacker who already has a foothold on a system, for example through malware or a compromised user account, could obtain higher privileges, potentially up to SYSTEM.

Affected

• Windows 10 Version 1607: 10.0.14393.0 to before 10.0.14393.9612 (CPE and Strix data; not listed in the Vulners data, verify on MSRC)
• Windows 10 Version 1809: 10.0.17763.0 to before 10.0.17763.9376
• Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7652
• Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9711
• Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9711
• Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3231
• Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9711
• Windows Server 2012 (including Server Core): 6.2.9200.0 to before 6.2.9200.26434
• Windows Server 2012 R2 (including Server Core): 6.3.9600.0 to before 6.3.9600.23470
• Windows Server 2016 (including Server Core): 10.0.14393.0 to before 10.0.14393.9612

Fixed in

• Install the latest Servicing Stack Update and the October 2026 cumulative update for the affected versions.
• Minimum fixed builds: 10.0.14393.9612 (1607, Server 2016), 10.0.17763.9376 (1809), 10.0.19044.7807 (21H2), 10.0.19045.7807 (22H2), 10.0.22631.7652 (23H2), 10.0.26100.9711 (24H2), 10.0.26200.9711 (25H2), 10.0.28000.3231 (26H1), 10.0.26300.9711 (26H2).
• Known KBs: KB5126651 (Windows 10 1809 / Server 2019), KB5126646 (Windows Server 2025). No KB identified for Windows 10 1607 or Server 2016.
• Server 2012 and 2012 R2 fixed builds: 6.2.9200.26434 and 6.3.9600.23470.

Workaround

Unknown.

Exploitation

• No known exploitation in the wild at the time of research.
• No public proof of concept found.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• EPSS 0.00404 (low predicted exploitation probability).

Our recommendation

• Confirm the fixed build for each host on the MSRC advisory page.
• Install the October 2026 cumulative and servicing stack updates on all affected Windows systems, with priority on shared systems and terminal servers.
• Identify Windows 10 1607 LTSB and Server 2016 systems; check whether they are still in support and plan an upgrade if they are not, since no further fixes may follow.
• Monitor for an official workaround or exploit reports and re-check the advisory.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Response Center: CVE-2026-83506 msrc.microsoft.com
• Vulners: CVE-2026-83506 vulners.com
• Vulners CVELIST: CVE-2026-83506 vulners.com
• Strix: CVE-2026-83506 www.strix.ai
• OpenCVE: CVE-2026-83506 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 03:43.