CVE-2026-83704
7.8HighPublished 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-59
Impact
A local authenticated attacker can elevate privileges to SYSTEM or full administrator. They require local access or an existing low-privileged shell on the target machine.
Root cause
The Windows Search Component improperly resolves symbolic links or junctions before accessing files.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Apply the relevant Microsoft security update from the vendor advisory. If patching must wait, stop and disable the Windows Search service (WSearch) to reduce exposure.
$ powershell -Command "Stop-Service -Name WSearch -PassThru; Set-Service -Name WSearch -StartupType Disabled"AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Improper link resolution before file access ('link following') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.