Microsoft Windows WebDAV: Remote code execution in Web Distributed Authoring and Versioning

Summary

A flaw in the Windows WebDAV component (improper resolution of path equivalence, CWE-41) allows an authenticated attacker with network access to execute code remotely. The attacker needs a valid low-privilege account, but no user interaction is required. Microsoft rates the flaw with CVSS 8.8 (High); the risk is highest for servers and file shares that run WebDAV and are reachable from the internet or branch offices.

Affected

• Windows 10 Version 1607 (builds below 10.0.14393.9612)
• Windows 10 Version 1809 (builds below 10.0.17763.9376)
• Windows 10 Version 21H2 (builds below 10.0.19044.7807)
• Windows 10 Version 22H2 (builds below 10.0.19045.7807)
• Windows 11 Version 23H2 (builds below 10.0.22631.7652)
• Windows 11 Version 24H2 (builds below 10.0.26100.9711)
• Windows 11 Version 25H2 (builds below 10.0.26200.9711)
• Windows 11 Version 26H1 (builds below 10.0.28000.3231)
• Windows 11 Version 26H2 (builds below 10.0.26300.9711)
• Windows Server 2012 and 2012 R2 (builds below 6.2.9200.26434 and 6.3.9600.23470)
• Windows Server 2016 (builds below 10.0.14393.9612)
• Windows Server 2019 and 2022 and 2025 (per vendor data; exact builds unconfirmed)

Fixed in

• Security update released on October 13, 2026 (per Microsoft)
• Named packages seen in third-party listings: KB5126646 (Windows Server 2025) and KB5126651 (Windows 10 1809 / Server 2019); not verified against MSRC
• Exact fixed build per edition: check the MSRC table, as the available data conflicts

Workaround

• Disable the WebDAV feature where it is not required
• Block WebDAV traffic from the internet at the firewall or reverse proxy, or restrict it to trusted networks and authenticated users
• Unconfirmed against the Microsoft advisory; patching remains the primary measure

Exploitation

• Microsoft temporal vector: exploit code maturity Unproven (E:U), report confidence Confirmed (RC:C)
• CISA SSVC: Exploitation none, Automatable no, Technical Impact total
• VulDB: no exploit available; the listed USD 5k-25k price is a broker estimate, not evidence of exploitation
• Not listed in CISA KEV; EPSS below 1%
• No public proof-of-concept found in the searches performed; this does not rule out one
• No known exploitation in the wild as of the sources reviewed

Our recommendation

• Patch affected Windows 10, 11 and Server systems in the October 2026 update cycle; verify the fixed build per edition on the MSRC page
• Identify systems where the WebDAV client or IIS WebDAV is active
• Disable WebDAV where it is not needed
• Where WebDAV is needed, block it from the internet and restrict access to trusted networks
• Review accounts for weak or reused passwords and enable multi-factor authentication
• Monitor WebDAV logs and re-check exploit sources for new public proof-of-concept code

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-88136 msrc.microsoft.com
• Vulners: MS:CVE-2026-88136 (NVD mirror, fixed builds) vulners.com
• OpenCVE: CVE-2026-88136 app.opencve.io
• VulDB: CVE-2026-88136 vuldb.com
• Vulners VulnRichment: CVE-2026-88136 (CISA SSVC) vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 18:10.