Microsoft Windows 10 1607: Elevation of privilege in EAPHost Service

Summary

A out-of-bounds write (CWE-787) in the Windows EAPHost Service allows an authorized local user to elevate privileges. The CVSS vector requires local access and a low-privilege account, with no user interaction. The flaw is not remotely exploitable, but a compromised user account or a malicious insider could gain SYSTEM rights after an initial foothold.

Affected

• Windows 10 Version 1607 (Enterprise LTSB 2016): builds 10.0.14393.0 to below 10.0.14393.9612
• Windows Server 2016: builds 10.0.14393.0 to below 10.0.14393.9612 (listed in the CNA record; MSRC to confirm)
• Windows 10 Version 1809: builds below 10.0.17763.9376
• Windows 10 Version 21H2: builds below 10.0.19044.7807
• Windows 10 Version 22H2: builds below 10.0.19045.7807
• Windows 11 Version 23H2: builds below 10.0.22631.7652
• Windows 11 Version 24H2: builds below 10.0.26100.9711
• Windows 11 Version 25H2: builds below 10.0.26200.9711
• Windows 11 Version 26H1: builds below 10.0.28000.3231
• Windows 11 Version 26H2: builds below 10.0.26300.9711
• Windows Server 2012 (incl. Server Core): builds below 6.2.9200.26434
• Windows Server 2012 R2 (incl. Server Core): builds below 6.3.9600.23470

Fixed in

• Windows 10 1607 / Windows Server 2016: build 10.0.14393.9612 (October 2026 update, KB5126868)
• Other versions: fixed builds as listed under Affected, delivered with the October 2026 cumulative update
• Confirm the fixed builds against the MSRC advisory before rollout

Workaround

Unknown. No vendor workaround was found.

• Limit local interactive logons on affected systems and remove unneeded local accounts (these reduce exposure but do not fix the flaw)

Exploitation

• No evidence of exploitation in the wild found.
• CISA SSVC (CNA data): Exploitation none, Automatable no, Technical Impact total.
• EPSS about 0.003.
• No public proof-of-concept found in a limited search; CISA KEV not checked directly.

Our recommendation

• Inventory all devices for Windows 10 1607 (LTSB 2016) and Windows Server 2016.
• Replace these devices or enrol them in Extended Security Updates (ESU) if replacement is not possible in time; the October 2026 build may be the last security fix for this branch without ESU.
• Deploy the October 2026 cumulative update on all other affected systems, after checking the reported Exchange Server issue with KB5126868.
• Restrict local logons on affected systems and monitor for privilege escalation.
• Treat current Windows 10/11 and Server 2022/2025 systems as a routine patch item.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-84016 msrc.microsoft.com
• Microsoft release health: Windows 10 1607 and Windows Server 2016 learn.microsoft.com
• OpenCVE: CVE-2026-84016 app.opencve.io
• Vulners: CVE-2026-84016 vulners.com
• Vulners Rapid7: CVE-2026-84016 (EPSS) vulners.com
• VulDB: CVE-2026-84016 vuldb.com
• 4sysops: Windows 10 Enterprise LTSB 2016 end of support and ESU 4sysops.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 02:29.