EUVD-2026-100372
GHSA-8hfj-h3gp-pr3f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege account
-
ExploitSend crafted WebDAV request with equivalent path
-
ExecutionBypass path-based access control
-
ImpactElevate privileges on target
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path traversal prevention
|
| Exploitation Conditions | Exploitation requires an existing authorized/authenticated account on the target (PR:L) with network reach to the WebDAV service; it is not exploitable by a fully unauthenticated attacker. The core condition is the WebDAV path-handling flaw (CWE-41, improper resolution of path equivalence): the attacker supplies an alternate but equivalent path representation so that access-control checks are evaluated against the wrong canonical path, bypassing authorization. Limiting factors: the WebDAV feature/role must be enabled and reachable over the network, and the attacker must already possess valid low-privilege credentials; no user interaction is needed (UI:N) and attack complexity is low (AC:L). The exact affected product, version, and configuration were not specified in the input and should be confirmed against the MSRC advisory. |
| Impact | This is a genuine high-priority vulnerability (CVSS 8.8). The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N indicates a network-exploitable, low-complexity attack requiring only low privileges (an existing authorized/authenticated foothold) and no user interaction, with high confidentiality, integrity, and availability impact - consistent with a privilege-elevation primitive. Exploitation status: no public exploit identified at time of analysis. The CVE is NOT in CISA KEV and no EPSS score, POC, or SSVC decision data was provided in the input, so real-world exploitation probability cannot be quantified from the available signals - the risk rating here rests on the CVSS vector and CWE alone. A notable conflict exists in the metadata: the single provided Tag is 'Information Disclosure', yet the description explicitly describes privilege elevation (elevation-of-privilege class), which the C:H/I:H/A:H impact profile supports - treat the 'Information Disclosure' categorization as unreliable. Bottom line: a credible EoP requiring a prior authenticated foothold; prioritize patching, but note the low-privilege prerequisite and absence of any exploitation evidence temper the urgency relative to an unauthenticated (PR:N) network flaw. |
| Exploit ScenarioDerived | An attacker who already holds a low-privileged authenticated account on the network sends a crafted WebDAV request that uses an equivalent/alternate representation of a protected path (CWE-41), causing the server to apply access controls to the wrong canonical path. This bypass lets the attacker reach resources or operations reserved for higher-privileged users, elevating their privileges. No public exploit code has been identified at time of analysis, and no user interaction is required (UI:N). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Authenticated privilege escalation in Microsoft WebDAV lets a low-privileged network user bypass authorization by supplying an alternate but equivalent path representation, causing access-control checks to be evaluated against the wrong canonical path; successful exploitation yields high confidentiality, integrity, and availability impact (CVSS 8.8, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires an existing authorized account on the target plus network reach to the WebDAV service - it is not exploitable by a fully unauthenticated attacker - but needs no user interaction and has low attack complexity. At time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified; patch availability was not specified in the provided intelligence and should be confirmed against the Microsoft MSRC advisory.
RemediationAI
Patch availability was not specified in the provided intelligence, so the first action is to check the Microsoft MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102217 and apply whatever fixed build it identifies; do not assume a fix is or is not available based on the absence of version data here. Until a vendor fix is confirmed and deployed, apply compensating controls that target the authorization bypass directly: disable the WebDAV feature or role entirely if it is not a business requirement (the trade-off is loss of WebDAV-based file publishing and remote authoring workflows), or if WebDAV is required, restrict network reach to the service with firewall rules and reverse-proxy allowlists limited to trusted client subnets so that only known authenticated populations can reach the endpoints (trade-off: legitimate remote and partner access is curtailed). Because the flaw depends on path canonicalization, deploy a front-end proxy or filter that rejects or normalizes non-canonical request paths - encoded dot segments, duplicate or trailing slashes, backslash variants, and mixed-case or Unicode-equivalent forms - before authorization is evaluated, accepting the trade-off that overly strict normalization rules can break legitimate clients using unusual but valid path encodings. Additionally, reduce the blast radius by auditing and minimizing privileges granted to low-privilege accounts that can reach WebDAV, and monitor for anomalous PROPFIND, PROPPATCH, COPY, and MOVE requests using alternate path encodings against protected collections.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 20 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-41, improper resolution of path equivalence, a canonicalization defect. WebDAV extends HTTP with methods such as PROPFIND, PROPPATCH, MKCOL, COPY, MOVE, LOCK and UNLOCK, each operating on a URL-identified resource path. When an implementation compares or authorizes paths without normalizing alternate but semantically equivalent representations - for example encoded dot segments, redundant or trailing slashes, mixed case, backslash versus forward slash, or Unicode normalization variants - an attacker can present a path that fails the authorization check yet resolves to the same protected resource, effectively bypassing access control. The flaw therefore sits at the intersection of URL canonicalization and authorization logic rather than in cryptography or memory safety. The assessed CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms a network-reachable, low-complexity attack with no user interaction and a required low-privilege account (PR:L), producing high impact across confidentiality, integrity, and availability within the unchanged security scope. The provided input does not include CPE data, so the exact affected product build, version range, and WebDAV deployment configuration must be confirmed from the Microsoft MSRC advisory; the accompanying tag classifies the observable effect as information disclosure, though the assessed vector indicates broader integrity and availability consequences as well.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable WebDAV (AV:N), low complexity (AC:L), requires an existing authorized account so PR:L, no user interaction, yielding full EoP impact (C/I/A:H).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Improper resolution of path equivalence in WebDAV allows an authorized attacker to elevate privileges over a network.
Executive ViewAI
A high-severity privilege-escalation flaw in Microsoft WebDAV (CVE-2026-102217, CVSS 8.8) allows anyone holding a valid low-privileged account to bypass authorization checks by supplying an alternate but equivalent path, effectively granting full read, write, and delete access to protected WebDAV content. Because only a legitimate account and network reach to the service are required - with no user interaction and low attack complexity - the realistic threat vectors are malicious insiders, compromised or reused credentials, and lateral movement from an already-breached host, all of which can expose or corrupt sensitive shared files. No vendor patch has been confirmed at time of analysis, so leadership should treat exposure as open-ended and drive containment through network restriction and WebDAV decommissioning until a fixed build is published.
No vendor-released patch identified at time of analysis. Interim mitigations: disable WebDAV publishing and the WebClient service on hosts where it is not business-required; restrict network access to WebDAV services to trusted segments/VPN only; enforce least privilege and MFA on all accounts with WebDAV access to shrink the pool of usable low-privilege credentials; segment WebDAV servers from general user networks; enable and monitor authorization, path-canonicalization, and file-access logging for anomalous path encodings and privilege escalation; and monitor the Microsoft MSRC advisory for an exact fixed version, applying it as soon as it is released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB