Microsoft Windows: Local privilege escalation in Portable Device Enumerator Service

Summary

A flaw in the Windows Portable Device Enumerator Service allows an attacker who already has local access and low privileges to elevate their privileges. No user interaction is required. The risk is mainly as a follow-up step after an attacker has already gained a foothold on a system, for example through malware running as a standard user.

Affected

• Windows 10 Version 1607 (build 10.0.14393.0 before 10.0.14393.9612)
• Windows 10 Version 1809 (build 10.0.17763.0 before 10.0.17763.9376)
• Windows 10 Version 21H2 (build 10.0.19044.0 before 10.0.19044.7807)
• Windows 10 Version 22H2 (build 10.0.19045.0 before 10.0.19045.7807)
• Windows 11 Version 23H2 (build 10.0.22631.0 before 10.0.22631.7652)
• Windows 11 Version 24H2, 25H2, 26H2 (see MSRC for exact builds)
• Windows 11 Version 26H1 (build 10.0.28000.0 before 10.0.28000.3231)
• Windows Server 2012 and 2012 R2, including Server Core (see MSRC for exact builds)
• Windows Server 2016 (build 10.0.14393.0 before 10.0.14393.9612)
• Note: the CPE data lists only Windows 10 1607. The CNA data lists the products above.

Fixed in

• Windows 10 1607 and Server 2016: 10.0.14393.9612
• Windows 10 1809: 10.0.17763.9376
• Windows 10 21H2: 10.0.19044.7807
• Windows 10 22H2: 10.0.19045.7807
• Windows 11 23H2: 10.0.22631.7652
• Windows 11 26H1: 10.0.28000.3231
• Windows Server 2012 and 2012 R2: see MSRC for the fixed builds
• Other editions: see the MSRC Security Update Guide for the cumulative update of October 2026

Workaround

Unknown. Microsoft's advisory does not confirm a workaround in the sources reviewed. A third-party database quotes guidance to disable the Windows Portable Device Enumerator Service if patching is not possible. This could not be confirmed on the MSRC page. Disabling the service may break phone or USB device access and needs testing first.

Exploitation

• CISA SSVC data: exploitation 'none', automatable 'no'.
• No CISA KEV listing, confirmed in-the-wild exploitation or public proof of concept was found. These are 'not found' results, not confirmed negatives.

Our recommendation

• Patch all affected Windows systems with the October 2026 cumulative update.
• Prioritise multi-user systems, terminal and RDS servers, and kiosks, where many users have local logon.
• Check whether any Windows 10 1607 systems are still in use. Check Microsoft's lifecycle page for support status; unpatched 1607 systems will not receive this fix.
• Re-check the CISA KEV catalog and public exploit sources for changes.
• Confirm the weakness type (NVD lists CWE-59, while the description says improper authorization) on MSRC or NVD before using it in detection rules.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-88133 msrc.microsoft.com
• Vulners: CVE-2026-88133 (CNA data mirror) vulners.com
• OpenCVE: CVE-2026-88133 app.opencve.io
• Qualys: Microsoft Patch Tuesday October 2026 review blog.qualys.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 01:17.