Microsoft Windows BITS: Remote code execution via use-after-free

Summary

A use-after-free flaw in the Windows Background Intelligent Transfer Service (BITS) allows an attacker to execute code over the network. According to the CVE description, the attacker does not need to be authenticated. The attack vector and privilege requirements in the supplied CVSS vector differ from the vendor scoring, so the score must be verified before it is used for prioritisation. Microsoft has published fixed builds for several Windows 10, Windows 11 and Windows Server versions. Exploitation is not known: the CVE is not listed in CISA KEV and no public proof of concept was found in our checks.

Affected

• Windows 10 Version 1607: builds below 10.0.14393.9612
• Windows 10 Version 1809: builds below 10.0.17763.9376
• Windows 10 Version 21H2: builds below 10.0.19044.7807
• Windows 10 Version 22H2: builds below 10.0.19045.7807
• Windows 11 Version 23H2: builds below 10.0.22631.7652
• Windows 11 Version 24H2: builds below 10.0.26100.9711
• Windows 11 Version 25H2: builds below 10.0.26200.9711
• Windows 11 Version 26H1: builds below 10.0.28000.3231
• Windows 11 Version 26H2: builds below 10.0.26300.9711
• Windows Server 2012 and 2012 R2 (including Server Core): builds below 6.2.9200.26434 and 6.3.9600.23470
• Windows Server 2016: builds below 10.0.14393.9612

Fixed in

• Fixed builds are listed in the affected section as the first build outside the vulnerable range.
• Windows 10 Version 1607: 10.0.14393.9612 (per vendor reference)
• Install the latest cumulative update for your version. KB numbers: Unknown.

Workaround

Unknown.

Exploitation

• Not listed in CISA KEV.
• CISA SSVC assessment: exploitation none, not automatable, technical impact total.
• No public proof of concept found in our searches; this does not rule out that one exists.

Our recommendation

• Inventory all Windows hosts, especially servers and Windows 10 Version 1607 devices, and check their build numbers against the table above.
• Install the security update from Microsoft in the next regular patch cycle, and prioritise internet-facing or sensitive systems.
• Verify the CVSS vector and the affected builds on the Microsoft Security Update Guide before finalising your risk rating.
• Check Microsoft's lifecycle pages to confirm that every device still receives security updates.
• Monitor the CISA KEV catalogue; raise the priority if exploitation is reported.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-88121 msrc.microsoft.com
• CNA record mirror (affected builds) vulners.com
• OpenCVE record (CVSS, CPE, KEV, SSVC) app.opencve.io
• Mirror with KB cross-references vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 18:12.