EUVD-2026-100398
GHSA-455h-gjpq-v2gc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local access to WSUS host
-
DeliveryAbuse incorrect default permissions on WSUS object
-
ExploitTrigger action requiring user interaction under high-complexity conditions
-
ExecutionEscalate to elevated/SYSTEM privileges
-
ImpactCompromise update service and host (C/I/A)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V13 - Configuration Default permission hardening
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the Windows Server Update Services (WSUS) role to be installed and running on the target, plus the attacker already having authenticated low-privileged local access to that server (PR:L, AV:L). Exploitation is further limited by required user interaction (UI:R) and high attack complexity (AC:H) - the attacker likely depends on a race condition or a privileged user/process performing a specific action, so it is not reliably or trivially triggerable. These factors (local-only, authenticated, interaction-dependent, complex) substantially narrow realistic exploitation despite the HIGH severity and scope change. |
| Impact | This is a local privilege-escalation flaw (CWE-276, incorrect default permissions) in Windows Server Update Services with a Microsoft-assigned CVSS 3.1 base of 7.5 (AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H). The HIGH severity is driven almost entirely by the scope change (S:C) and full C/I/A impact, NOT by ease of exploitation: the vector requires LOCAL access (AV:L), already-held low privileges (PR:L - an authorized/authenticated attacker), user interaction (UI:R), and HIGH attack complexity (AC:H), meaning several conditions must align for success. There is no EPSS score, no CISA KEV listing, and no public exploit in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net: this is a meaningful but not emergency issue - a real elevation-of-privilege risk on WSUS servers that should be patched in normal Patch-Tuesday cadence, but the local vector, required privileges, user interaction, and high complexity make opportunistic mass exploitation unlikely. Note: only a single MSRC reference is provided; EPSS/KEV/POC are absent (absence is not a negative signal, but it limits confidence that this is being exploited). |
| Exploit ScenarioDerived | A low-privileged but authenticated local user on a Windows Server running the WSUS role abuses weak default permissions on a WSUS resource to escalate privileges. Because the attack has high complexity and requires user interaction, the attacker likely must win a race or induce a privileged user/process to act before gaining SYSTEM-level control. No public proof-of-concept is identified in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Local privilege escalation in WSUS (Windows Server Update Services) allows an authenticated low-privileged attacker with local access to elevate privileges by exploiting incorrect default permissions (CWE-276). The vulnerability has a Microsoft-assigned CVSS 3.1 score of 7.5 (AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H), indicating high attack complexity and required user interaction, but it can lead to full compromise of confidentiality, integrity, and availability. No public exploit identified at time of analysis, and a patch is available per the Microsoft advisory.
RemediationAI
Microsoft has released a security update to address this vulnerability; apply the patch from the advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105009. Until patching is possible, restrict local interactive logon to the WSUS server to only trusted administrators, as the attacker requires authenticated low-privileged access (PR:L). Additionally, monitor for unusual privilege escalation attempts and ensure that WSUS service accounts and directories have least-privilege permissions. Note that WSUS is a server role; reducing the number of local users can mitigate the risk. The patch should be applied promptly given the high impact (C:H/I:H/A:H), though exploitation is complex and requires user interaction.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 11 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WSUS is a Microsoft role that enables administrators to manage and distribute updates for Microsoft products. The vulnerability stems from incorrect default permissions (CWE-276) on certain WSUS resources, likely allowing a low-privileged local user to modify files, registry keys, or service configurations that are later used by a privileged process, resulting in privilege escalation. The CVSS vector (AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H) indicates the attack must be launched locally, requires the attacker to already have low privileges, necessitates user interaction (e.g., a privileged user performing a specific action), and has high complexity, possibly involving a race condition. The scope change (S:C) implies the vulnerable component can impact resources beyond its security scope, such as gaining SYSTEM or administrative privileges. The WSUS role must be installed and running on the target server.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
Local EoP by an authenticated low-priv user (AV:L/PR:L) needing interaction and a hard-to-win race (UI:R/AC:H); weak permissions yield full SYSTEM compromise crossing a trust boundary (S:C, C/I/A:H).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Incorrect default permissions in Windows Server Update Service allows an authorized attacker to elevate privileges locally.
Executive ViewAI
Windows Server Update Services (WSUS), the infrastructure many organizations use to distribute patches across their entire Windows estate, contains a local privilege-escalation flaw that allows an attacker who already holds a low-privileged account on a WSUS server to gain full administrative control of that system. Because a compromised WSUS server can influence update delivery to every managed endpoint, the potential blast radius extends well beyond a single host to the broader Windows environment. No public exploit code has been identified at the time of analysis and no vendor fix version could be confirmed, so leadership should treat this as a near-term access-control and monitoring problem rather than a patching problem.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict local interactive logon on WSUS servers to a minimal set of privileged administrators; remove unnecessary local administrator rights and enforce least privilege; harden ACLs on WSUS content and configuration paths to correct insecure default permissions (CWE-276); enable and monitor verbose WSUS and Windows security auditing for privilege and configuration changes; deploy EDR detection for token manipulation and privilege-escalation techniques; apply application allowlisting on WSUS hosts; and network-segment WSUS servers so that obtaining an initial local foothold is difficult. Note that exploitation requires authenticated local access and user interaction, which materially reduces opportunistic risk.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB