Microsoft Windows WebDAV: Elevation of privilege via improper access control
Summary
A flaw in the WebDAV component of Microsoft Windows allows an authorized local user to elevate privileges. An attacker who already has a low-privilege local account can gain higher rights, with high impact on confidentiality, integrity and availability. No user interaction is required, but local access is needed.
Affected
- Windows 10 Version 1607, 1809, 21H2, 22H2
- Windows 11 Version 23H2, 24H2, 25H2, 26H1, 26H2
- Windows Server 2012, 2012 R2, 2016 (including Server Core installations)
The affected build ranges are taken from the CVE record of the CNA Microsoft. Verify the exact ranges per edition in the MSRC product table.
Fixed in
Fixed in the October 2026 Microsoft security updates. Exact fixed builds and KB numbers per version: Unknown (see MSRC).
Workaround
Unknown from the vendor. Third-party sources suggest disabling the WebDAV feature or its components where they are not required, and limiting local accounts to least privilege. Verify on MSRC before relying on this.
Exploitation
- Not known to be exploited in the wild (MSRC: Exploited: No).
- Not listed in the CISA KEV catalog.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- No public proof-of-concept exploit known.
Our recommendation
- Install the October 2026 Windows security updates on all affected systems, prioritizing multi-user machines, terminal or RDS servers and servers with WebDAV enabled.
- Check whether WebDAV is required; if not, disable it.
- Review local accounts and remove unneeded ones and unnecessary administrative rights.
- Monitor for unusual local privilege changes on systems with multiple users.
Information from Microsoft (Patch Tuesday October 2026)
- Severity (Microsoft)
- Important
- Impact
- Elevation of privilege – WebDAV
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5126651, KB5126655, KB5126657, KB5126646, KB5127648, KB5126653
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MSRC Security Update Guide: CVE-2026-88135 msrc.microsoft.com
- SentinelOne Vulnerability Database: CVE-2026-88135 www.sentinelone.com
- OpenCVE: CVE-2026-88135 app.opencve.io
- Strix: CVE-2026-88135 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 01:18.
Original description (NVD)
Improper access control in WebDAV allows an authorized attacker to elevate privileges locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.