Windows BITS: Use-after-free leads to local privilege escalation

Summary

A use-after-free flaw in the Windows Background Intelligent Transfer Service (BITS) allows an authorized local attacker to elevate privileges. The attacker needs a low-privileged account on the affected system and no user interaction. Successful exploitation could grant SYSTEM-level control of the host. Microsoft rates the CVSS score as 7.8 (High), and no exploitation or public exploit code is known.

Affected

• Windows 10 Version 1607 (10.0.14393.0 to below 10.0.14393.9612)
• Windows Server 2016 (10.0.14393.0 to below 10.0.14393.9612)
• Windows 10 Version 1809, 21H2, 22H2
• Windows 11 Version 23H2, 24H2, 25H2, 26H1, 26H2
• Windows Server 2012 and 2012 R2 (Server Core and full installation)

Fixed in

• Windows 10 Version 1607 and Server 2016: 10.0.14393.9612 according to the CNA record (verify in the MSRC table before rollout)
• Other branches: see the MSRC update guide for the fixed builds
• Cumulative update for Windows 10 1607: KB5126868 (October 2026); the KB page excerpt does not list this CVE, so confirm it

Workaround

• No workaround documented by Microsoft.
• Interim control: restrict local logon and standard-user access on affected hosts until the update is installed.

Exploitation

• Not listed in the CISA KEV catalog.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• No public proof-of-concept found in the sources reviewed.
• Exploited in the wild: Unknown. Check the MSRC Exploited flag.

Our recommendation

• Inventory all Windows 10 1607 and Server 2016 hosts and verify the build with winver or the registry.
• Install the October 2026 security update and confirm the build against the MSRC table.
• Prioritise shared, terminal and servers and workstations where users run untrusted content.
• Plan an upgrade of devices still on Windows 10 1607, as this branch is end of life.
• Monitor the Microsoft-Windows-Bits-Client and Service Control Manager event logs for unusual service restarts or job activity.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-88152 msrc.microsoft.com
• Microsoft KB5126868: Windows 10 1607 security update (October 2026) support.microsoft.com
• SentinelOne vulnerability database: CVE-2026-88152 www.sentinelone.com
• OpenCVE: CVE-2026-88152 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 01:15.