CVE-2026-83499
Full vulnerability record from the local CVENow database.
Description
Insufficient granularity of access control in Windows Server Update Service allows an authorized attacker to elevate privileges locally.
Severity
HIGH
CVSS score
7.8
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2026-10-13 19:19:55.003000
Last modified
2026-10-28 17:52:59.137000
View original CVE JSON
{
"id": "CVE-2026-83499",
"sourceIdentifier": "[email protected]",
"published": "2026-10-13T19:19:55.003",
"lastModified": "2026-10-28T17:52:59.137",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Insufficient granularity of access control in Windows Server Update Service allows an authorized attacker to elevate privileges locally."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Microsoft",
"product": "Windows 10 Version 1607",
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"versions": [
{
"version": "10.0.14393.0",
"lessThan": "10.0.14393.9612",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Microsoft",
"product": "Windows 10 Version 1809",
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"versions": [
{
"version": "10.0.17763.0",
"lessThan": "10.0.17763.9376",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Microsoft",
"product": "Windows Server 2012",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "6.2.9200.0",
"lessThan": "6.2.9200.26434",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Microsoft",
"product": "Windows Server 2012 (Server Core installation)",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "6.2.9200.0",
"lessThan": "6.2.9200.26434",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Microsoft",
"product": "Windows Server 2012 R2",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "6.3.9600.0",
"lessThan": "6.3.9600.23470",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Microsoft",
"product": "Windows Server 2012 R2 (Server Core installation)",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "6.3.9600.0",
"lessThan": "6.3.9600.23470",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Microsoft",
"product": "Windows Server 2016",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "10.0.14393.0",
"lessThan": "10.0.14393.9612",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Microsoft",
"product": "Windows Server 2016 (Server Core installation)",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "10.0.14393.0",
"lessThan": "10.0.14393.9612",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Microsoft",
"product": "Windows Server 2019",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "10.0.17763.0",
"lessThan": "10.0.17763.9376",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Microsoft",
"product": "Windows Server 2019 (Server Core installation)",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "10.0.17763.0",
"lessThan": "10.0.17763.9376",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Microsoft",
"product": "Windows Server 2022",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "10.0.20348.0",
"lessThan": "10.0.20348.5761",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Microsoft",
"product": "Windows Server 2025",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "10.0.26100.0",
"lessThan": "10.0.26100.33650",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Microsoft",
"product": "Windows Server 2025 (Server Core installation)",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "10.0.26100.0",
"lessThan": "10.0.26100.33650",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-10-16T00:00:00+00:00",
"id": "CVE-2026-83499",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-1220"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*",
"versionEndExcluding": "10.0.14393.9612",
"matchCriteriaId": "1F4158F1-A617-466F-BBC1-B4272D5A2E45"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*",
"versionEndExcluding": "10.0.14393.9612",
"matchCriteriaId": "AE808C08-3E9C-49D4-A3B5-0E3EC438543A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*",
"versionEndExcluding": "10.0.17763.9376",
"matchCriteriaId": "15BDFD52-C4C7-440A-B97C-D7637E77AFAC"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*",
"versionEndExcluding": "10.0.17763.9376",
"matchCriteriaId": "A1A74FEC-9922-4060-A2C0-06080FB4DDA8"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A7DF96F8-BA6A-4780-9CA3-F719B3F81074"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*",
"matchCriteriaId": "DB18C4CE-5917-401E-ACF7-2747084FD36E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:x64:*",
"versionEndExcluding": "10.0.14393.9612",
"matchCriteriaId": "D2A98BDA-8301-431C-BD7D-27C318AF2397"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:x64:*",
"versionEndExcluding": "10.0.17763.9376",
"matchCriteriaId": "D8CE3341-8771-4A25-9BF6-2A280D9C536C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:x64:*",
"versionEndExcluding": "10.0.20348.5761",
"matchCriteriaId": "A98E694F-9390-488A-A7FB-3E7BF7E988F8"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:x64:*",
"versionEndExcluding": "10.0.26100.33650",
"matchCriteriaId": "D95E80FE-F34C-4805-9A66-75D090E65BBB"
}
]
}
]
}
],
"references": [
{
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83499",
"source": "[email protected]",
"tags": [
"Patch",
"Vendor Advisory"
]
}
]
}