Windows ReFS CVE-2026-83586

Exploitation requires the Windows Resilient File System (ReFS) Deduplication Service to be active, which in turn requires a ReFS volume with the Data Deduplication feature installed and enabled - an optional, non-default configuration most common on file/storage servers rather than typical client desktops. The attacker must already possess authenticated low-privilege local access to the host (AV:L/PR:L); there is no remote or unauthenticated path and no user-interaction requirement (UI:N). Affected builds are specific: Windows Server 2025 below 10.0.26100.33650, Windows 11 24H2/25H2/26H2 below *.9711, 26H1 below 10.0.28000.3231, and 23H2 below 10.0.22631.7652 - patched builds are not exploitable. These factors (local access plus an opt-in storage feature) substantially limit the realistically exposed population.

This is a moderate-priority local privilege escalation. The CVSS vector (AV:L/AC:L/PR:L/UI:N) describes a low-complexity attack requiring the attacker to already have low-privileged authenticated local access, with high impact to confidentiality, integrity, and availability (C:H/I:H/A:H) - consistent with the 7.8 base score and CWE-1390 (weak authentication). The signals are largely consistent with each other and point away from mass exploitation: CISA's SSVC framework marks Exploitation as 'none' and Automatable as 'no', while rating Technical Impact as 'total', meaning that a successful attack fully compromises the host but the flaw is not amenable to automated, wormable exploitation and requires an attacker to first land on the box. No EPSS score, KEV listing, or public POC is present in the provided data, so there is no evidence of in-the-wild use. The practical risk is further gated by the fact that the vulnerable component is the ReFS Deduplication Service, an optional storage feature that is not enabled on default Windows installations, which meaningfully narrows the exposed population below the raw ubiquity of Windows itself. Net assessment: patch on a normal cadence as part of Microsoft's update cycle; this is a legitimate post-compromise/insider escalation risk rather than a drop-everything internet-facing emergency.

A low-privileged user who already has local access to a Windows Server 2025 or Windows 11 host on which ReFS deduplication is enabled abuses the weak authentication in the ReFS Deduplication Service to execute code in the service's privileged context, gaining SYSTEM-level control. No user interaction is required, and the low attack complexity means exploitation is reliable once local access is obtained. No public exploit code is identified at time of analysis.