Windows Encrypting File System (EFS): Remote code execution vulnerability

Summary

A code injection flaw (CWE-94) in the Windows Encrypting File System (EFS) allows an attacker with low privileges to execute code over the network. Successful exploitation would give the attacker full control over confidentiality, integrity and availability of the affected system (CVSS 3.1: 8.8). Microsoft describes the attacker as authorized, and the sources do not state whether the attack path is reachable from the internet.

Affected

• Windows 10 Version 1607 and Windows Server 2016 (including Server Core): 10.0.14393.0 to before 10.0.14393.9612
• Windows 10 Version 1809 and Windows Server 2019 (including Server Core): 10.0.17763.0 to before 10.0.17763.9376
• Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7652
• Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9711
• Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9711
• Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3231
• Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9711
• Windows Server 2022: 10.0.20348.0 to before 10.0.20348.5761

Fixed in

• Install the October 2026 security update for each affected version. Fixed builds are listed in the affected section above (per the CNA record).
• Windows 10 Version 1607 / Server 2016: fixed in build 10.0.14393.9612 or later. Verify the build against the MSRC table.
• KB number for Windows 10 1607 / Server 2016: Unknown.

Workaround

Unknown. No vendor workaround was found in the sources. Check the MSRC FAQ and mitigations section.

Exploitation

• In the wild: No evidence found. CISA SSVC lists exploitation as 'none' and automatable as 'no'.
• Public proof of concept: None found.
• EPSS: below 1%.

Our recommendation

• Inventory all Windows 10 Version 1607 and Server 2016 hosts and check whether EFS is in use.
• Install the October 2026 update on all affected systems and confirm the build number against the MSRC table.
• Windows 10 Version 1607 (LTSB) reached end of support on 13 October 2026 and will not receive this or later security fixes. Replace these devices or isolate them from the network as an exception risk.
• Restrict network access to file servers and affected hosts, and limit which accounts hold valid logons.
• Monitor MSRC and CISA for changes to the exploitation status.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-83759 msrc.microsoft.com
• OpenCVE: CVE-2026-83759 app.opencve.io
• Vulners (MSCVE): MS:CVE-2026-83759 vulners.com
• Vulners (NVD): NVD:CVE-2026-83759 vulners.com
• Strix: CVE-2026-83759 www.strix.ai
• Microsoft release information learn.microsoft.com
• Wikipedia: Windows 10 version 1607 en.wikipedia.org
• Insentra: Windows 10 LTSB end of support www.insentragroup.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 18:33.