Microsoft Windows EFS: Absolute path traversal allows privilege escalation

Summary

Microsoft Windows Encrypting File System (EFS) contains an absolute path traversal flaw (CWE-36) that allows an authorized attacker to elevate privileges over the network. The attacker needs a valid low-privileged account, but no user interaction is required. The CVSS 3.1 base score is 8.8 (High), with total impact on confidentiality, integrity and availability.

Affected

• Windows 10 Version 1607 (10.0.14393.0 to < 10.0.14393.9612)
• Windows 10 Version 1809 (10.0.17763.0 to < 10.0.17763.9376)
• Windows 10 Version 21H2 (10.0.19044.0 to < 10.0.19044.7807)
• Windows 10 Version 22H2 (10.0.19045.0 to < 10.0.19045.7807)
• Windows 11 Version 23H2 (10.0.22631.0 to < 10.0.22631.7652)
• Windows 11 Version 24H2 (10.0.26100.0 to < 10.0.26100.9711)
• Windows 11 Version 25H2 (10.0.26200.0 to < 10.0.26200.9711)
• Windows 11 Version 26H1 (10.0.28000.0 to < 10.0.28000.3231)
• Windows 11 Version 26H2 (10.0.26300.0 to < 10.0.26300.9711)
• Windows Server 2012 (6.2.9200.0 to < 6.2.9200.26434), including Server Core
• Windows Server 2012 R2 (6.3.9600.0 to < 6.3.9600.23470), including Server Core
• Windows Server 2016 (10.0.14393.0 to < 10.0.14393.9612)

Fixed in

• Windows 10 Version 1607 and Windows Server 2016: 10.0.14393.9612 or later
• Windows 10 Version 1809: 10.0.17763.9376 or later
• Windows 10 Version 21H2: 10.0.19044.7807 or later
• Windows 10 Version 22H2: 10.0.19045.7807 or later
• Windows 11 Version 23H2: 10.0.22631.7652 or later
• Windows 11 Version 24H2, 25H2 and 26H2: 10.0.26100.9711, 10.0.26200.9711 and 10.0.26300.9711 or later
• Windows 11 Version 26H1: 10.0.28000.3231 or later
• Windows Server 2012 and 2012 R2: 6.2.9200.26434 and 6.3.9600.23470 or later
• Security update released on October 13, 2026. The KB number for Windows 10 Version 1607 is unknown and must be taken from the MSRC advisory.

Workaround

Unknown. No vendor-documented mitigation has been identified beyond applying the security update.

Exploitation

• Not exploited in the wild according to the MSRC advisory.
• Not publicly disclosed according to the MSRC advisory.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• Not listed in the CISA KEV catalog.
• EPSS below 1%.
• No public proof-of-concept found in the limited searches performed.

Our recommendation

• Inventory all Windows 10 Version 1607, Windows 10 Version 1809 and Windows Server 2012, 2012 R2 and 2016 systems and confirm their support status.
• Install the October 13, 2026 security update (or a later one) on all affected systems. Plan an upgrade where support has ended.
• Review accounts with access to shared or encrypted file stores and restrict local logon where possible.
• Monitor the MSRC advisory and the CISA KEV catalog for changes, such as published exploit code or active exploitation.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide advisory msrc.microsoft.com
• MSRC mirror (impact and exploitability) msrc.microsoft.com
• Vulners MSCVE record (version ranges) vulners.com
• Vulners NVD record vulners.com
• OpenCVE CVE record (SSVC, KEV, EPSS) app.opencve.io
• Strix CVE record www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 18:31.