EUVD-2026-73438
GHSA-pxpr-rmjm-pg69
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local access with low privilege suffices; symlink creation is trivial; full C/I/A reflects successful privilege escalation to SYSTEM.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
4DescriptionCVE.org
Improper link resolution before file access ('link following') in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in Windows Setup Files Cleanup affects virtually all supported Windows versions, from Server 2012 through Windows 11 26H1. The component improperly resolves symbolic links or junction points during file access operations, allowing a low-privileged local user to redirect cleanup actions to attacker-chosen file paths, effectively gaining write access to protected system locations. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid local user account on the target system (PR:L), sufficient to create symbolic links or junction points in a filesystem location accessible to the Windows Setup Files Cleanup component. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately characterizes a straightforward local privilege escalation: no network access, no elevated privileges needed to exploit, no user interaction required, and full C/I/A impact upon success. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Microsoft security update corresponding to each installed Windows version as listed in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69289. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and catalog all Windows systems in the environment, prioritizing production servers and critical infrastructure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allShare
External POC / Exploit Code
Leaving vuln.today