Windows Server Update Service Elevation of Privilege Vulnerability
Plan PatchCVSS 7.8CVE-2026-83499Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary
A vulnerability in Windows Server Update Service (WSUS) allows an authorized local user to escalate privileges to administrator level due to insufficient granularity of access control. The vulnerability affects Windows Server 2016, 2019, 2022, 2025 and Windows 10 versions 1607 and 1809. Exploitation is assessed as less likely.
What this means
What could happen
A user with local access to a Windows server running WSUS could exploit insufficient access control to escalate their privileges to administrator level, potentially allowing them to modify system configurations, install malware, or disrupt critical services.
Who's at risk
Windows Server administrators and IT staff responsible for patch management infrastructure. Affects Windows Server 2016, 2019, 2022, and 2025 systems running Windows Server Update Service (WSUS), as well as Windows 10 systems (versions 1607 and 1809) that may be used for administrative purposes or WSUS management.
How it could be exploited
An attacker with an unprivileged local user account on a Windows server running WSUS could leverage insufficient granularity in WSUS access controls to escalate their privileges to system or administrator level without requiring additional credentials or complex exploitation techniques.
Prerequisites
- Local user account on Windows server running WSUS
- Low-privilege credentials (non-administrator)
- Physical or remote desktop access to the server
Low-complexity local privilege escalationRequires local access or accountAffects widely-deployed Windows Server versionsCould compromise patch management infrastructure integrity
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (12)
12 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/3
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXApply the October 2026 security update to all affected Windows Server and Windows 10 systems
Long-term hardening
0/2HARDENINGRestrict local logon access to Windows servers running WSUS to authorized personnel only via Group Policy or local account policies
HARDENINGReview and enforce principle of least privilege for all user accounts accessing WSUS servers
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/a83c947c-11fe-41b5-a663-d375317fd3c1Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.