Windows: Elevation of privilege in COM+ Event System Service

Summary

The Windows COM+ Event System Service contains an untrusted pointer dereference that allows a local, authorized attacker to elevate privileges. Affected are Windows 10 (1607 to 22H2), Windows 11 (23H2 to 26H2), Windows Server 2012, 2012 R2 and 2016. An attacker needs a foothold on the system first, for example through a compromised standard user account, and can then gain SYSTEM rights. The attack is not directly reachable from the internet.

Affected

• Windows 10 Version 1607 (and Windows Server 2016): builds below 10.0.14393.9612
• Windows 10 Version 1809: builds below 10.0.17763.9376
• Windows 10 Version 21H2: builds below 10.0.19044.7807
• Windows 10 Version 22H2: builds below 10.0.19045.7807
• Windows 11 Version 23H2: builds below 10.0.22631.7652
• Windows 11 Version 24H2 and 25H2: builds below 10.0.26100.9711 and 10.0.26200.9711
• Windows 11 Version 26H1: builds below 10.0.28000.3231
• Windows 11 Version 26H2: builds below 10.0.26300.9711
• Windows Server 2012 (including Server Core): builds below 6.2.9200.26434
• Windows Server 2012 R2 (including Server Core): builds below 6.3.9600.23470

Fixed in

• Windows 10 1607 / Server 2016: 10.0.14393.9612 (October 2026 cumulative update, KB5126868 according to research notes)
• Windows 10 1809: 10.0.17763.9376
• Windows 10 21H2 and 22H2: 10.0.19044.7807 and 10.0.19045.7807
• Windows 11 23H2: 10.0.22631.7652
• Windows 11 24H2 and 25H2: 10.0.26100.9711 and 10.0.26200.9711
• Windows 11 26H1: 10.0.28000.3231
• Windows 11 26H2: 10.0.26300.9711
• Windows Server 2012: 6.2.9200.26434
• Windows Server 2012 R2: 6.3.9600.23470

Workaround

Unknown. No vendor-published workaround was found. Installing the security update is the remedy.

Exploitation

• Microsoft: publicly disclosed No, exploited No at release
• CISA SSVC: exploitation none, automatable no, technical impact total
• No public proof of concept or in-the-wild exploitation found in the sources reviewed
• Local attack path, low privileges required

Our recommendation

• Install the October 2026 security update on all affected systems, prioritising servers and shared devices
• Inventory Windows 10 1607 devices: Windows 10 Enterprise LTSB 2016 reached end of updates on 13 October 2026, so no further fixes will follow; plan replacement or upgrade to a supported release
• Test the update before rollout where Exchange Server is involved, as research notes mention reported mail and OWA issues after this update
• Enforce least privilege and restrict local logon on kiosks, terminals and other fixed-function devices
• Monitor for unusual privilege escalation on endpoints

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-83848 msrc.microsoft.com
• Microsoft Security Update Guide (en-US): CVE-2026-83848 msrc.microsoft.com
• CVE CNA data mirror (Vulners): CVE-2026-83848 vulners.com
• Windows 10 1607 and Windows Server 2016 release health status learn.microsoft.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 02:51.