Windows Search Component: Link following leads to local privilege escalation

Summary

A link-following flaw (CWE-59) in the Microsoft Windows Search Component allows an attacker with a local, low-privileged account to elevate privileges. Successful exploitation can give full control over confidentiality, integrity and availability of the affected system. The attacker needs local access and a valid user account; the flaw is not remotely exploitable.

Affected

• Windows 10 Version 1607: 10.0.14393.0 to before 10.0.14393.9612
• Windows Server 2016 (including Server Core): 10.0.14393.0 to before 10.0.14393.9612
• Windows 10 Version 1809 and Windows Server 2019: 10.0.17763.0 to before 10.0.17763.9376
• Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7652
• Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9711
• Windows 11 Version 25H2 and 26H2: 10.0.26200.0 and 10.0.26300.0 to before 10.0.26200.9711 and 10.0.26300.9711
• Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3231
• Windows Server 2012 R2 (including Server Core): 6.3.9600.0 to before 6.3.9600.23470

Fixed in

• Windows 10 Version 1607 and Windows Server 2016: OS Build 14393.9612 (KB5126868, released October 13, 2026)
• Later out-of-band build for Windows 10 Version 1607: KB5134123 (OS Build 14393.9615), listed for October 26, 2026
• Other products: fixed builds as listed in the affected section, per the CVE record
• Verify the exact product list on the MSRC Security Update Guide, as it could not be fully confirmed from the vendor page

Workaround

• No vendor workaround identified. Status: unknown.

Exploitation

• CISA SSVC assessment: exploitation none, automatable no, technical impact total.
• Tenable reports exploits available and a CISA KEV due date of 10/16/2026, but this may refer to the whole bulletin. Not confirmed.
• VulDB reports no known exploit and unknown technical details.
• No public proof of concept found.
• Verify the CISA KEV catalog directly for CVE-2026-88191.

Our recommendation

• Patch Windows 10 Version 1607 and Windows Server 2016 to at least OS Build 14393.9612, preferably the later out-of-band build.
• Check whether the Windows 10 Enterprise LTSB 2016 end-of-support date of October 13, 2026 applies to your systems on Microsoft's lifecycle page. If so, plan an upgrade, not only patching.
• Prioritise shared PCs, terminal servers, RDS hosts and file servers, and limit local logon and standard user accounts where possible until patched.
• Test patches on Exchange hosts first, because Microsoft lists an Exchange/OWA sign-in issue tied to the October 2026 update (marked mitigated).
• Check the CISA KEV catalog and monitor vendor updates for changes in exploitation status.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-88191 msrc.microsoft.com
• Microsoft KB5126868: Windows 10 1607 security update support.microsoft.com
• Tenable Nessus plugin 365471 www.tenable.com
• VulDB entry 419499 vuldb.com
• Strix CVE-2026-88191 www.strix.ai
• Talos: Microsoft Patch Tuesday October 2026 blog.talosintelligence.com
• Qualys: Microsoft Patch Tuesday October 2026 review blog.qualys.com
• Microsoft release health: Windows 10 1607 and Windows Server 2016 status learn.microsoft.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 01:06.