Windows 11: Elevation of privilege in ReFS Deduplication Service

Summary

A flaw in the Deduplication Service of the Windows Resilient File System (ReFS) allows a local user with low privileges to elevate their rights, potentially up to SYSTEM level. The weakness is classified as weak authentication (CWE-1390). Exploitation requires an existing local account and is not possible remotely; the vendor rates the impact on confidentiality, integrity and availability as high.

Affected

• Windows 11 version 23H2: 10.0.22631.0 to before 10.0.22631.7652
• Windows 11 version 24H2: 10.0.26100.0 to before 10.0.26100.9711
• Windows 11 version 25H2: 10.0.26200.0 to before 10.0.26200.9711
• Windows 11 version 26H1: 10.0.28000.0 to before 10.0.28000.3231
• Windows 11 version 26H2: 10.0.26300.0 to before 10.0.26300.9711
• Windows Server 2025 (including Server Core): 10.0.26100.0 to before 10.0.26100.33650

Fixed in

• October 2026 Windows security update, which brings the affected builds to the fixed versions listed above or later.
• Third-party sources name KB5126653 (Windows 11 23H2) and KB5126646 (Windows Server 2025); verify these in the Microsoft Update Catalog before deployment.

Workaround

• Unknown in the vendor advisory.
• Unofficial guidance: if ReFS Deduplication is not required, disable the ReFS Deduplication Service to remove the attack surface. Patching remains the primary fix.

Exploitation

• No known exploitation; not listed in CISA KEV.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• No public proof of concept found; this is not a confirmed absence.
• EPSS about 0.3 percent (third-party data).

Our recommendation

• Install the October 2026 Windows security update on Windows 11 and Windows Server 2025 systems, starting with file servers and systems that use ReFS volumes.
• Check whether ReFS Deduplication is enabled; if it is not needed, consider disabling it as an interim measure.
• Limit local accounts and logon rights on affected systems and monitor for unexpected privilege changes.
• Verify the build numbers against the MSRC Security Update Guide.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-83586 msrc.microsoft.com
• NVD entry via Vulners vulners.com
• Microsoft advisory mirror via Vulners vulners.com
• OpenCVE: CVE-2026-83586 app.opencve.io
• Intruder CVE Monitor: CVE-2026-83586 cvemon.intruder.io
• Strix: CVE-2026-83586 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 03:36.