CVE-2026-69783
HighCVSS 7.8Summary
External control of file name or path in Windows Update allows an authorized attacker to elevate privileges locally.
Risk Assessment
An attacker with local access could manipulate file paths, potentially leading to privilege escalation and system integrity compromise.
Recommendation
Install the latest Windows security updates and restrict permissions to directories used by Windows Update.
Other vulnerabilities in Windows Update
See all- CVE-2026-96323High
A use after free in Windows Update allows an authorized attacker to elevate privileges locally. The flaw exists in the Windows update mechanism.
- CVE-2026-69999Medium
Out-of-bounds read in Windows Update allows an authorized attacker to disclose information locally.
- CVE-2026-69882High
Untrusted search path in Windows Update allows an authorized attacker to elevate privileges locally.
- CVE-2026-69733High
Untrusted search path in Windows Update allows an authorized attacker to elevate privileges locally.
- CVE-2026-69718High
Improper neutralization of special elements used in a command ('command injection') in Windows Update allows an authorized attacker to elevate privileges locally.
- CVE-2026-69673High
Improper link resolution before file access ('link following') in Windows Update allows an authorized attacker to elevate privileges locally.
- CVE-2026-69633High
Heap-based buffer overflow in Windows Update allows an authorized attacker to elevate privileges locally.
Original NVD description (English source)
External control of file name or path in Windows Update allows an authorized attacker to elevate privileges locally.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS