Windows Shell: Relative path traversal leads to local privilege escalation

Summary

A relative path traversal flaw (CWE-23) in Windows Shell allows an authorized local user to elevate privileges. An attacker needs a valid low-privilege account and local access, so this is typically a follow-up step after phishing or credential theft. Confidentiality, integrity and availability impact is rated high (CVSS 7.8); the CNA record covers multiple Windows 10, Windows 11 and Windows Server builds, including Windows 10 1607.

Affected

• Windows 10 Version 1607: 10.0.14393.0 to < 10.0.14393.9612
• Windows 10 Version 1809: 10.0.17763.0 to < 10.0.17763.9376
• Windows 10 Version 21H2: 10.0.19044.0 to < 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.0 to < 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.0 to < 10.0.22631.7652
• Windows 11 Version 24H2: 10.0.26100.0 to < 10.0.26100.9711
• Windows 11 Version 25H2: 10.0.26200.0 to < 10.0.26200.9711
• Windows 11 Version 26H1: 10.0.28000.0 to < 10.0.28000.3231
• Windows 11 Version 26H2: 10.0.26300.0 to < 10.0.26300.9711
• Windows Server 2012 and Server Core: 6.2.9200.0 to < 6.2.9200.26434
• Windows Server 2012 R2 and Server Core: 6.3.9600.0 to < 6.3.9600.23470
• Windows Server 2016: 10.0.14393.0 to < 10.0.14393.9612

Fixed in

• Fixed in the October 2026 Microsoft security update for each affected build (fixed build numbers as listed in the CNA record above)
• Windows 10 Version 1607: 10.0.14393.9612
• KB number for Windows 10 1607: Unknown.
• Verify the KB articles and fixed builds in the MSRC Security Update Guide before rollout.

Workaround

• None documented. Unknown.
• Applying the security update is the remedy.

Exploitation

• CISA SSVC assessment: Exploitation none, Automatable no, Technical Impact total.
• EPSS score 0.00392 (very low).
• No public proof of concept or in-the-wild exploitation found in the sources reviewed. Absence from search results is not proof; re-check the CISA KEV catalog before closing.

Our recommendation

• Install the October 2026 Microsoft security update on all affected systems, prioritising shared terminal servers and multi-user machines.
• Identify any Windows 10 Version 1607 systems; they are out of mainstream support. Upgrade them or isolate them from untrusted users.
• Restrict local logon to necessary accounts and monitor for suspicious local privilege changes.
• Re-check the CISA KEV catalog and the MSRC advisory for updates.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-83873 msrc.microsoft.com
• OpenCVE: CVE-2026-83873 app.opencve.io
• Vulners CVE list record: CVE-2026-83873 vulners.com
• Vulners NVD mirror: CVE-2026-83873 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 02:44.