Microsoft Windows 10: Local privilege escalation via registry link following
Summary
Windows 10 Version 21H2 contains a flaw in the Windows Registry where links are resolved improperly before a file is accessed (CWE-59, link following). An authorized local user can exploit it to gain elevated privileges. The attacker needs a local account or code execution on the system first, and no remote attack vector is described.
Affected
- Microsoft Windows 10 Version 21H2: 10.0.19044.0 to below 10.0.19044.7807
- Microsoft Windows 10 Version 22H2: 10.0.19045.0 to below 10.0.19045.7807
- Microsoft Windows 11 Versions 23H2, 24H2, 25H2, 26H1, 26H2 and Windows Server 2022, 2025 (per the CVE record, see source)
Fixed in
- Windows 10 Version 21H2: build 10.0.19044.7807 or later (per the CNA record; not yet verified on the MSRC page)
- Install the Microsoft security update of October 2026 on all affected releases
- KB article for 21H2: Unknown
Workaround
Unknown. No vendor-documented workaround is known; patching is the documented fix.
Exploitation
- Microsoft: publicly disclosed No, exploited No, exploitation more likely
- CISA SSVC: exploitation none, automatable no, technical impact total
- No public exploit code found in the research; not confirmed in the CISA KEV catalog at time of research
Our recommendation
- Identify all Windows 10 21H2 systems and confirm their support status with Microsoft; unsupported systems will not receive a fix
- Install the October 2026 security update on affected systems, starting with shared PCs, terminal servers and high-value systems
- Until patched, limit local logons on shared machines and remove unnecessary local administrator rights
- Monitor for suspicious local activity and recheck CISA KEV for changes
Information from Microsoft (Patch Tuesday October 2026)
- Severity (Microsoft)
- Important
- Impact
- Elevation of privilege – Windows Registry
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation more likely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5126655, KB5126657, KB5126646, KB5127648, KB5126653, KB5127646
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-83927 msrc.microsoft.com
- NVD mirror on Vulners: CVE-2026-83927 vulners.com
- OpenCVE: CVE-2026-83927 (CVSS, CISA SSVC) app.opencve.io
- Microsoft Vulners mirror: MS:CVE-2026-83927 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 02:31.
Original description (NVD)
Improper link resolution before file access ('link following') in Windows Registry allows an authorized attacker to elevate privileges locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.