Windows WebDAV CVE-2026-88136

Requires the Windows WebDAV capability (the WebClient service / WebDAV handling) to be enabled and network-reachable; this service is not enabled by default on all Windows SKUs, which limits exposure. The attacker must be authenticated at a low privilege level (CVSS PR:L) - exploitation is not available to fully unauthenticated attackers. No user interaction is required (UI:N), and no non-default feature beyond WebDAV itself is specified. Patched builds are enumerated per product (e.g., Windows Server 2022 >=10.0.20348.5761, Windows 11 24H2 >=10.0.26100.9711); applying the vendor update removes the condition.

This is a genuinely high-priority vulnerability by composition of signals, though not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes network-reachable, low-complexity exploitation requiring only low-level authentication and no user interaction, yielding full compromise of confidentiality, integrity, and availability (C:H/I:H/A:H) - consistent with the description's 'execute code over a network.' CISA's SSVC framework corroborates the severity on impact (Technical Impact: total) but tempers urgency: Exploitation is rated 'none' (no observed exploitation) and Automatable 'no' (not amenable to mass, scripted exploitation), which aligns with the requirement for prior authentication. No EPSS score was provided, and there is no CISA KEV listing and no public POC, so real-world exploitation pressure currently appears low despite the high base score. Note a metadata conflict: the single tag provided is 'Information Disclosure,' yet both the description (code execution) and the full C/I/A:H impact indicate remote code execution, not mere disclosure - the tag understates the vulnerability. Net: treat as a priority patch for any host where the WebDAV/WebClient service is reachable and attackers can obtain low-privilege credentials, but the authentication prerequisite and non-automatable nature make it a serious-but-not-wormable issue rather than a drop-everything zero-day.

An attacker who already holds low-privilege credentials (or has compromised a standard account) reaches a Windows host exposing the WebDAV service over the network and submits a crafted request exploiting improper path-equivalence resolution to run arbitrary code in the service context. No public exploit code has been identified, and CVSS AC:L suggests the exploitation technique, once known, would be straightforward and reliable. Because UI:N, no victim interaction is needed once the attacker is authenticated.