CVE-2026-83999

Published: Sep 8, 2026Modified: Sep 11, 2026

7.0

Vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.0 / Impact: 5.9

Source: secure@microsoft.com (Secondary)

Description

Improper link resolution before file access ('link following') in Windows Resilient File System (ReFS) Deduplication Service allows an authorized attacker to elevate privileges locally.

Affected (7)

Products: Microsoft: Windows 11 24h2, Windows 11 25h2, Windows 11 26h1, Windows Server 2025

4 products

Configuration A

7 vulnerable

Vulnerable Software	Affected Versions
Microsoft Windows 11 24h2	Before 10.0.26100.9445
Microsoft Windows 11 24h2	Before 10.0.26100.9445
Microsoft Windows 11 25h2	Before 10.0.26200.9445
Microsoft Windows 11 25h2	Before 10.0.26200.9445
Microsoft Windows 11 26h1	Before 10.0.28000.2954
Microsoft Windows 11 26h1	Before 10.0.28000.2954
Microsoft Windows Server 2025	Before 10.0.26100.33438

Related CWEs

CWE-59

Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

References (1)

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83999

Source: secure@microsoft.com

PatchVendor Advisory

Timeline

No history available yet.