Oct 2026: Windows Server Update Service Elevation of Privilege Vulnerability
CVE-2026-105009 Published on October 13, 2026

Windows Server Update Service Elevation of Privilege Vulnerability
Incorrect default permissions in Windows Server Update Service allows an authorized attacker to elevate privileges locally.

Vendor Advisory NVD

Vulnerability Analysis

Exploitation:

NONE

Automatable:

NO

Technical Impact:

TOTAL

Weakness Type

Incorrect Default Permissions

During installation, installed file permissions are set to allow anyone to modify those files.

Products Associated with CVE-2026-105009

Want to know whenever a new CVE is published for Microsoft products? stack.watch will email you.

Microsoft Windows Server 2012

  Watch

Microsoft Windows Server 2012 R2

  Watch

Microsoft Windows Server 2016

  Watch

Microsoft Windows Server 2019

  Watch

Microsoft Windows Server 2022

  Watch

Microsoft Windows Server 2025

  Watch

Affected Versions

• Version 6.2.9200.0 and below 6.2.9200.26434 is affected.

• Version 6.2.9200.0 and below 6.2.9200.26434 is affected.

• Version 6.3.9600.0 and below 6.3.9600.23470 is affected.

• Version 6.3.9600.0 and below 6.3.9600.23470 is affected.

• Version 10.0.14393.0 and below 10.0.14393.9612 is affected.

• Version 10.0.14393.0 and below 10.0.14393.9612 is affected.

• Version 10.0.17763.0 and below 10.0.17763.9376 is affected.

• Version 10.0.17763.0 and below 10.0.17763.9376 is affected.

• Version 10.0.20348.0 and below 10.0.20348.5761 is affected.

• Version 10.0.26100.0 and below 10.0.26100.33650 is affected.

• Version 10.0.26100.0 and below 10.0.26100.33650 is affected.

Exploit Probability