Windows Server Update Service Elevation of Privilege Vulnerability
Plan PatchCVSS 7.5CVE-2026-105009Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityHigh
User InteractionRequired
Summary
A vulnerability in Windows Server Update Service (WSUS) allows an authorized local user to escalate privileges to administrative level due to incorrect default permissions on WSUS. This affects Windows Server 2016, 2019, 2022, and 2025 (including Server Core installations). Vendor fixes are available for all affected versions through October 2026 security updates.
What this means
What could happen
A user with local access to a Windows Server running WSUS could gain administrative privileges on that server, potentially allowing them to modify system settings, access sensitive data, or disrupt critical services.
Who's at risk
IT infrastructure teams managing Windows Server environments, particularly those running Windows Server 2016, 2019, 2022, or 2025 (including Server Core installations). This affects any organization using Windows Server Update Service for patch management in hybrid or on-premises networks.
How it could be exploited
An attacker with a local user account on a Windows Server must interact with the Windows Server Update Service (likely through a GUI or script interface) to trigger the privilege escalation. The attack requires local access and user interaction, making it a lower-risk remote scenario but a higher concern for insider threats or compromised local accounts.
Prerequisites
- Local user account on the Windows Server
- User interaction required (UI interaction)
- Elevated file system or service permissions required by the vulnerability
Low complexity exploitationRequires local access and user interaction
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (8)
8 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/5
Schedule — requires maintenance window
0/4Patching may require device reboot — plan for process interruption
Windows Server 2016
HOTFIXUpdate Windows Server 2016 to Build 10.0.14393.9612 or later via Windows Update or WSUS
Windows Server 2019
HOTFIXUpdate Windows Server 2019 to Build 10.0.17763.9376 or later via Windows Update or WSUS
Windows Server 2022
HOTFIXUpdate Windows Server 2022 to Build 10.0.20348.5761 or later via Windows Update or WSUS
Windows Server 2025
HOTFIXUpdate Windows Server 2025 to Build 10.0.26100.33650 or later via Windows Update or WSUS
Long-term hardening
0/1HARDENINGReview and restrict local user accounts on Windows Servers to only those who require interactive access
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/fb688380-9a97-4d44-890f-2674740697c1Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.