EUVD-2026-99593
GHSA-9694-x87f-93fc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local low-privileged session
-
ExploitInvoke EFS operation with improper authorization
-
ExecutionBypass authorization check
-
ImpactTamper with protected data integrity
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an interactive local session on an affected Windows host with at least low-level privileges (AV:L, PR:L) and specifically targets the Encrypting File System (EFS) component's authorization logic; the attacker must already be an authorized/logged-in user. Limiting factors that reduce real-world risk: the attack is strictly local (no network vector), it needs pre-existing valid credentials or an established foothold, user interaction is not required (UI:N) but a local session is, and only integrity is affected (C:N/A:N) - there is no data disclosure or denial of service. Patched builds are available for each listed Windows version (e.g., Windows 11 24H2 fixed in 10.0.26100.9711, Server 2025 in 10.0.26100.33650), so patched systems are not exposed. |
| Impact | This is a genuinely moderate, low-urgency issue rather than a high-priority emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base 5.5) describes a local attack requiring low privileges (PR:L) with only an integrity impact (I:H) - no confidentiality or availability loss. All exploitation signals point the same direction: SSVC records Exploitation=none, Automatable=no, and Technical Impact=partial; there is no CISA KEV listing and no public POC, so exploitation status is 'no public exploit identified at time of analysis.' The signals are internally consistent - a local, authenticated tampering flaw with no automation and no observed exploitation. The CWE (CWE-863 Improper Authorization) aligns with the description's authorization-bypass theme, though the 'Authentication Bypass' tag is a loose fit since the weakness is authorization, not authentication. Bottom line: a legitimate patch-in-cycle item for Windows fleets, not a drop-everything priority. |
| Exploit ScenarioDerived | A local, already-authenticated low-privileged user on an affected Windows host abuses improper authorization in the Encrypting File System (EFS) to tamper with data or EFS-protected resources they should not be permitted to modify. No public exploit code is known and the attack cannot be performed remotely or without an existing local session, so realistic abuse requires prior foothold on the machine. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Improper authorization in the Windows Encrypting File System (EFS) lets an already-logged-in local user tamper with protected data that they should not be permitted to modify, yielding a high integrity impact with no confidentiality or availability impact (CVSS 5.5, AV:L/PR:L/UI:N, C:N/I:H/A:N). Only Windows 10, Windows 11, and Windows Server hosts that have not yet applied the current cumulative updates are exposed; the attack is strictly local, requires an interactive session and at least low-level privileges, and there is no public exploit identified at time of analysis (no CISA KEV entry, SSVC exploitation: none, EPSS not notable). This is a genuinely moderate, low-urgency issue rather than a high-priority emergency: vendor patches already exist for every affected build, so exposure is limited to unpatched systems where a low-privileged local user could subvert EFS authorization checks.
RemediationAI
Apply the vendor-released cumulative update that matches each affected build, using the exact fix versions tracked against CVE-2026-88162 in the MSRC advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88162): Windows 11 23H2 → 10.0.22631.7652; Windows 11 24H2 → 10.0.26100.9711; Windows 11 25H2 → 10.0.26200.9711; Windows 11 26H1 → 10.0.28000.3231; Windows 11 26H2 → 10.0.26300.9711; Windows 10 1607 and Server 2016 → 10.0.14393.9612; Windows 10 1809 and Server 2019 → 10.0.17763.9376; Windows 10 21H2 → 10.0.19044.7807 (verify the correct 22H2 build against the MSRC advisory, since the feed lists 19045.0 with the 19044.7807 threshold); Windows Server 2022 → 10.0.20348.5761; Windows Server 2025 → 10.0.26100.33650. Because exploitation requires an existing interactive local session with at least low privileges, the highest-value compensating controls are shrinking the local attack surface rather than network filtering: remove or disable unnecessary interactive local accounts and shared local-admin credentials, restrict who may log on locally ("Allow log on locally" / RDP access groups) and enforce least privilege so a foothold cannot reach EFS operations - trade-off is reduced administrative convenience for on-console support staff. If EFS is not a sanctioned data-protection mechanism in your environment, disable it fleet-wide via Group Policy (Computer Configuration → Windows Settings → Security Settings → Public Key Policies → Encrypting File System, or the EFS-related policy under File System) so the vulnerable authorization path cannot be exercised - trade-off is that legitimate user-driven file encryption stops working and any existing encrypted files remain encrypted and require their recovery keys. As a detective control, monitor EFS-related activity (duplicate/recovery certificate use, cipher operations, and writes to EFS-encrypted directories) via Sysmon or Windows auditing of object access on encrypted paths - trade-off is additional event volume and tuning effort. No vendor-released workaround substitutes for patching, no public exploit code is known at time of analysis, and the SSVC assessment (Exploitation: none, Automatable: no, Technical Impact: partial) supports routine patch-cycle remediation rather than emergency out-of-band deployment.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 16 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Encrypting File System (EFS) is the Windows component that provides transparent file-level encryption on NTFS volumes, binding encrypted files to user certificates and enforcing access through a set of authorization checks in the EFS/minifilter and CryptAPI paths. The root cause class here is CWE-863 (Incorrect Authorization): the EFS code path fails to correctly validate that the calling principal is entitled to perform the requested operation, so a low-privileged local user with a valid session can carry out tampering that should be gated behind stronger authorization. The published CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N confirms the shape of the flaw - local access only, low complexity, authenticated (low-privilege) attacker, no user interaction, unchanged scope, and impact confined to integrity. Because the flaw is in the authorization logic rather than in cryptography, patching is the only complete fix; no certificate, key, or ciphertext weakness is implied. The EUVD feed's affected-version data maps the defect across the Windows 10, Windows 11, and Windows Server servicing branches (including Server Core installations), consistent with a shared EFS code base. Note that the EUVD entry lists Windows 10 22H2 (10.0.19045.0) against the same 10.0.19044.7807 fix threshold as 21H2, which appears to be a data-feed artifact rather than a distinct build line.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Local-only EFS tampering by an already-authorized low-privileged user gives AV:L/PR:L; only integrity is affected, so C:N/I:H/A:N with no scope change.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Improper authorization in Windows Encrypting File System (EFS) allows an authorized attacker to perform tampering locally.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network
Exploit-DB