Skip to main content
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Authenticate to adjacent network
  2. Delivery
    Send crafted telephony service request
  3. Exploit
    Manipulate file path parameter
  4. Execution
    Trigger privilege escalation
  5. Impact
    Execute code as SYSTEM

Vulnerability Assessment

Weakness
CWE
CWE-73
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File name/path control
Exploitation Conditions

Authenticated user on adjacent network with access to Windows Telephony Service. Requires local or network adjacency to target system with Telephony Service enabled and vulnerable file path handling in telephony operations.
Impact

CVSS 8.0 (HIGH). Attack vector: Adjacent Network. Complexity: Low. Privileges required: Low. User interaction: None. Exploitable via remote/network.
Exploit ScenarioDerived

A remote attacker could exploit this vulnerability to compromise the affected system.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.8% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Windows Telephony Service on multiple Windows versions (10, 11, Server 2008/2022) contains an improper file path control vulnerability that enables authenticated attackers on the same network to escalate privileges to system level. An attacker with local user credentials can manipulate file name or path parameters to achieve elevated privileges without user interaction. No patch is currently available, though the vulnerability has high exploitability potential (EPSS 0.8%).

Earlier versions of this analysis (1)
v1 Mar 12, 2026 - 21:54 CVSS 8.0

External control of file name or path in Windows Telephony Service allows an authorized attacker to elevate privileges over an adjacent network. [CVSS 8.0 HIGH]

RemediationAI

Monitor vendor advisories for a patch.

Affected Packages

microsoft windows_10_version_1607_10_0_14393_8783 fix: Windows 10 Version 1607 for 32-bit Systems 10.0.14393.8783, Windows 10 Version 1607 for x64-based Systems 10.0.14393.8783
microsoft windows_10_version_1809_10_0_17763_8276 fix: Windows 10 Version 1809 for 32-bit Systems 10.0.17763.8276, Windows 10 Version 1809 for x64-based Systems 10.0.17763.8276
microsoft windows_10_version_21h2_10_0_19044_6809 fix: Windows 10 Version 21H2 for 32-bit Systems 10.0.19044.6809, Windows 10 Version 21H2 for ARM64-based Systems 10.0.19044.6809, Windows 10 Version 21H2 for x64-based Systems 10.0.19044.6809
microsoft windows_10_version_22h2_10_0_19045_6809 fix: Windows 10 Version 22H2 for 32-bit Systems 10.0.19045.6809, Windows 10 Version 22H2 for ARM64-based Systems 10.0.19045.6809, Windows 10 Version 22H2 for x64-based Systems 10.0.19045.6809
microsoft windows_11_version_23h2_10_0_22631_6491 fix: Windows 11 Version 23H2 for ARM64-based Systems 10.0.22631.6491, Windows 11 Version 23H2 for x64-based Systems 10.0.22631.6491
microsoft windows_11_version_24h2_10_0_26100_7623 fix: Windows 11 Version 24H2 for ARM64-based Systems 10.0.26100.7623, Windows 11 Version 24H2 for x64-based Systems 10.0.26100.7623
microsoft windows_11_version_25h2_10_0_26200_7623 fix: Windows 11 Version 25H2 for ARM64-based Systems 10.0.26200.7623, Windows 11 Version 25H2 for x64-based Systems 10.0.26200.7623
microsoft windows_server_2008_6_0_6003_23717 fix: Windows Server 2008 for 32-bit Systems Service Pack 2 6.0.6003.23717, Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) 6.0.6003.23717, Windows Server 2008 for x64-based Systems Service Pack 2 6.0.6003.23717, Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) 6.0.6003.23717
microsoft windows_server_2008_r2_6_1_7601_28117 fix: Windows Server 2008 R2 for x64-based Systems Service Pack 1 6.1.7601.28117, Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) 6.1.7601.28117
microsoft windows_server_2012_6_2_9200_25868 fix: Windows Server 2012 6.2.9200.25868, Windows Server 2012 (Server Core installation) 6.2.9200.25868
microsoft windows_server_2012_r2_6_3_9600_22968 fix: Windows Server 2012 R2 6.3.9600.22968, Windows Server 2012 R2 (Server Core installation) 6.3.9600.22968
microsoft windows_server_2016_10_0_14393_8783 fix: Windows Server 2016 10.0.14393.8783, Windows Server 2016 (Server Core installation) 10.0.14393.8783
microsoft windows_server_2019_10_0_17763_8276 fix: Windows Server 2019 10.0.17763.8276, Windows Server 2019 (Server Core installation) 10.0.17763.8276
microsoft windows_server_2022_10_0_20348_4648 fix: Windows Server 2022 10.0.20348.4648, Windows Server 2022 (Server Core installation) 10.0.20348.4648
microsoft windows_server_2022_23h2_edition_10_0_25398_2092 fix: Windows Server 2022, 23H2 Edition (Server Core installation) 10.0.25398.2092
microsoft windows_server_2025_10_0_26100_32230 fix: Windows Server 2025 10.0.26100.32230, Windows Server 2025 (Server Core installation) 10.0.26100.32230

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 16 packages in microsoft

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Affects the Windows Telephony component of Windows 10 1607. External control of file name or path in Windows Telephony Service allows an authorized attacker to elevate privileges over an adjacent network.

Know when Windows 10 1607 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (microsoft) PRIMARY 8.0 HIGH
AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (microsoft) · only source for this CVE.

CVSS VectorVendor: microsoft

Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

DescriptionCVE.org

External control of file name or path in Windows Telephony Service allows an authorized attacker to elevate privileges over an adjacent network.

Executive ViewAI

Why It Matters

Organizations using External control of file name or path in Windows Telephony Service face notable risk from CVE-2026-20931 rated CVSS 8.0. Successful exploitation could significantly impact the confidentiality, integrity, or availability of affected systems. Organizations should apply vendor updates when available and consider compensating controls in the interim.

Business Impact: High
Compensating Controls

Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.

Threat Intelligence Overview

EPSS Score
0.8%
Top 27% exploitable
Data Quality
4 sources
Confidence: Medium
NVD CVE.org EPSS VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.8%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Controlled
Automatable· derived
No
Human Impact
High

Priority Score

41
Low Medium High Critical
KEV: 0
EPSS: +1
CVSS: +40
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Affected Products (CPE)CVE.org

cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*

More in Windows 10 1607

View all
CVE-2021-40444 HIGH POC
8.8 Sep 15

Windows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
CVE-2021-34527 HIGH POC
8.8 Jul 02

<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
CVE-2022-30190 HIGH POC
7.8 Jun 01

Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
CVE-2017-0147 HIGH POC
7.5 Mar 17

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
CVE-2018-8174 HIGH POC
7.5 May 09

The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
CVE-2021-1675 HIGH POC
7.8 Jun 08

Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
CVE-2016-7255 HIGH POC
7.8 Nov 10

The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited

CVE-2023-36884 HIGH POC
7.5 Jul 11

Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2024-30088 HIGH POC
7.0 Jun 11

Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
CVE-2019-1458 HIGH POC
7.8 Dec 10

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in

CVE-2018-8453 HIGH POC
7.8 Oct 10

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in

Same weakness CWE-73 – External Control of File Name or Path

View all
CVE-2024-8517 CRITICAL POC
9.8
CVE-2025-33053 HIGH POC
8.8
CVE-2023-4634 CRITICAL POC
9.8
CVE-2025-24054 MEDIUM POC
6.5
CVE-2026-96656 HIGH POC
8.6
CVE-2021-21343 HIGH POC
7.5
CVE-2025-0111 HIGH
7.1
CVE-2024-55372 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8

References

Advisories & patches
ADVISORY https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20931 ADVISORY https://vuldb.com/vuln/340819 REF https://www.vicarius.io/vsociety/posts/cve-2026-20931-detection-script-elevation-of-privilege-vulnerability-in-windows-telephony-service REF https://www.vicarius.io/vsociety/posts/cve-2026-20931-mitigation-script-elevation-of-privilege-vulnerability-in-windows-telephony-service

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy