Microsoft Windows BITS: Use-after-free allows remote code execution
Summary
A use-after-free flaw in the Windows Background Intelligent Transfer Service (BITS) allows an unauthorized attacker to execute code over the network. The attack requires no privileges or user interaction, but its complexity is high. BITS is a background file transfer component used by Windows Update and other software, so affected systems should be treated as a priority.
Affected
- Windows 10 Version 1607 (before 10.0.14393.9612)
- Windows 10 Version 1809 (before 10.0.17763.9376)
- Windows Server 2012 and Server Core (before 6.2.9200.26434)
- Windows Server 2012 R2 and Server Core (before 6.3.9600.23470)
- Windows Server 2016 and Server Core (before 10.0.14393.9612)
- Windows Server 2019 and Server Core (before 10.0.17763.9376)
- Windows Server 2022 (before 10.0.20348.5761)
- Windows Server 2025 and Server Core (before 10.0.26100.33650)
Fixed in
- Install the October 2026 security update for each affected product, which provides the builds listed above or later.
- KB numbers: Unknown. Verify the exact update on the MSRC advisory.
Workaround
Unknown. No vendor-documented workaround was identified in the sources.
Exploitation
According to the CISA SSVC assessment, Exploitation is none and Automatable is no. No public proof of concept or in-the-wild exploitation was found in the sources.
Our recommendation
- Inventory all Windows 10 1607 and 1809 hosts and Windows Server 2012 to 2025 hosts, including Server Core installations.
- Apply the October 2026 cumulative updates via Windows Update or WSUS and verify build numbers against the MSRC advisory.
- Prioritise hosts with network exposure and unsupported OS versions, such as Windows Server 2012 without Extended Security Updates.
- Restrict inbound and outbound network access to affected hosts where feasible.
- Monitor for unusual BITS activity and check for new public exploit information.
Information from Microsoft (Patch Tuesday October 2026)
- Severity (Microsoft)
- Important
- Impact
- Remote code execution – Windows Background Intelligent Transfer Service (BITS)
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation unlikely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5126651, KB5126655, KB5126646, KB5126868, KB5126835, KB5126836
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-88173 msrc.microsoft.com
- Vulners CVELIST: CVE-2026-88173 vulners.com
- Vulners MSCVE: MS:CVE-2026-88173 vulners.com
- Vulners VulnRichment: CVE-2026-88173 vulners.com
- Strix: CVE-2026-88173 www.strix.ai
- OpenCVE: CVE-2026-88173 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 19:15.
Original description (NVD)
Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.