EUVD-2026-100096
GHSA-886f-89q2-5f52
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain adjacent-network position
-
DeliveryAuthenticate with low privileges
-
ExploitSend crafted BITS network request
-
ExecutionTrigger use-after-free in BITS
-
PersistGroom freed memory object
-
ImpactExecute arbitrary code
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to (1) occupy an adjacent network position relative to the target - the CVSS AV:A rules out direct internet-wide exploitation and implies the same broadcast/subnet or logically adjacent segment - and (2) already possess low-privilege authenticated access (PR:L), meaning this is not a pre-authentication remote flaw. No user interaction is needed (UI:N). The vulnerable component is the Windows Background Intelligent Transfer Service (BITS), which is present and running by default across Windows client and server builds, so no non-default feature toggle is required on the target side. Primary limiting factors for defenders: network segmentation that blocks adjacency and controls on low-privilege account access both meaningfully reduce exploitability. |
| Impact | Multiple signals converge on this being a genuinely serious-but-not-emergency flaw rather than an inflated high-CVSS issue. The CVSS 3.1 base of 8.0 (AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) describes code execution with total confidentiality, integrity, and availability impact, which matches CISA's SSVC 'Technical Impact: total' rating. However, the vector itself tempers urgency: AV:A limits the attacker to the adjacent/local network segment rather than the open internet, and PR:L requires the attacker to already hold low-level authenticated access. SSVC further reports 'Exploitation: none' and 'Automatable: no,' and there is no CISA KEV listing and no POC referenced in the provided data, so this is not currently weaponized or self-propagating. EPSS is not provided in the input, so exploitation probability cannot be quantified here. The tags include 'Denial Of Service' while the description and impact metrics describe full remote code execution - the RCE framing should be treated as primary. Net assessment: patch on a prioritized (not drop-everything) cadence, weighted up because the product is Windows and the impact is total, weighted down because exploitation requires adjacent network position plus existing low-privilege authentication and no in-the-wild activity is confirmed. |
| Exploit ScenarioDerived | An attacker who already has a low-privileged authenticated foothold on a machine within the same logical/adjacent network sends crafted traffic to the Windows BITS service, triggering a use-after-free condition. By grooming the freed object, the attacker achieves arbitrary code execution with the privileges of the vulnerable service. No public exploit or POC is identified at time of analysis, and no user interaction is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Use-after-free in the Windows Background Intelligent Transfer Service (BITS) allows an attacker who already holds low-privilege credentials and occupies an adjacent network position - the same broadcast domain or a logically adjacent segment - to corrupt memory and execute code in the context of the BITS service on Windows 10, Windows 11 and Windows Server 2012 through 2025. No user interaction is required and BITS is installed and running by default on every affected build, but the AV:A/PR:L prerequisites place this firmly outside the pre-authentication, internet-wide exploitation class. There is no public exploit code identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' with automatable 'no', and vendor patches are available; the realistic reading is a genuinely serious, patch-now flaw rather than an inflated high-CVSS emergency, with priority going to segmented environments that still expose adjacency and to hosts where low-privilege accounts are widely held.
RemediationAI
Patch status per vendor data is 'available from vendor', and the primary action is to apply the current Microsoft cumulative security update for each affected branch via the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88121 - install the build at or above the fixed threshold for each branch (for example Windows Server 2022 at 10.0.20348.5761, Windows Server 2019 at 10.0.17763.9376, Windows 11 23H2 at 10.0.22631.7652, and the corresponding builds listed for Windows 10 and the remaining Windows 11 and Windows Server releases), and verify post-install build numbers rather than trusting patch-scan output alone, since the fix is delivered inside the OS servicing stack. Because exploitation requires adjacent-network reachability plus low-privilege credentials, the highest-value compensating controls are architectural: segment or firewall off BITS/RPC traffic from untrusted or guest VLANs so that hostile tenants cannot reach the DCOM/RPC endpoints (trade-off: this also breaks legitimate cross-segment BITS-based content distribution, WSUS, and SCCM pulls, so scope the rules to untrusted segments rather than all internal ones); and tighten low-privilege account hygiene - disable or password-vault local accounts that do not need interactive or network logon and remove unnecessary domain users from any group that can authenticate to file servers (trade-off: helpdesk and service workflows that rely on shared low-privilege accounts will break and must be re-provisioned). Disabling the BITS service entirely is technically possible (sc config bits start= disabled) but is a blunt instrument with real cost: it breaks Windows Update delivery optimisation, WSUS and ConfigMgr content downloads and any application using BITS for updates, so use it only on isolated, non-updating hosts as a stopgap. Detection should focus on unexpected BITS job creation, abnormal svchost/BITS crashes, and RPC connections to the BITS endpoint from non-management subnets, since no public exploit code is known and any such activity is anomalous.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 20 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
BITS is a Windows service (hosted in svchost.exe, historically the QMGR queue manager) that performs asynchronous, resumable background file transfers on behalf of Windows Update, WSUS, SCCM/ConfigMgr, and third-party updaters. It exposes COM/RPC interfaces - notably IBackgroundCopyManager and related job/queue objects - over the network, which is why the assessed vector is AV:A rather than AV:N: reachability requires the attacker to be on an adjacent segment rather than anywhere on the internet, but the request itself is network-borne and requires no UI:N interaction. The root cause class is CWE-416 (use-after-free): an object, buffer or job structure is released while a reference to it remains live, and the subsequent dereference of the stale pointer gives an attacker the classic heap-reuse primitive - reallocate the freed chunk with attacker-influenced data, then drive the service into using the attacker-controlled contents as a pointer or vtable target. Microsoft's severity for this class is code execution with full loss of confidentiality, integrity and availability (C:H/I:H/A:H, S:U), and CISA's SSVC technical-impact rating of 'total' is consistent with that: success yields code running under the BITS service account (frequently SYSTEM-level on default configurations), not merely a crash, despite the 'Denial Of Service' and 'Memory Corruption' tags also attached to the record. Authentication is confirmed as required and low-privilege by the PR:L metric in the assessed CVSS vector, so this is not a pre-auth remote flaw and cannot be triggered by an unauthenticated network scanner.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AV:A because the service is reachable from the adjacent network, PR:L because an authenticated low-privilege foothold is required, and total RCE impact yields C:H/I:H/A:H.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized attacker to execute code over a network.
Executive ViewAI
Windows Background Intelligent Transfer Service (BITS) on Windows 10, Windows 11, and Windows Server 2012 through 2025 has a high-severity memory corruption flaw that can allow an attacker with low-privilege credentials and adjacent network access to execute code in the BITS service context. Because BITS is installed and running by default on affected builds, organizations with flat or poorly segmented internal networks face elevated risk, especially where low-privilege accounts are widely used. No public exploit identified at time of analysis and Patch available per vendor advisory, so leadership should prioritize rapid patching and network segmentation rather than emergency internet-facing response.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB