CVE-2026-88136
8.8HighPublished 13 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-41
Impact
Authenticated attackers with network access can execute arbitrary code on the target system. They only need low-privilege valid credentials to exploit the service remotely.
Root cause
Improper resolution of equivalent paths in the WebDAV handler allows path traversal or validation bypass leading to code execution.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Install the official security update from Microsoft for CVE-2026-88136; as an immediate workaround, disable the WebDAV publishing service or block incoming WebDAV traffic on IIS.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Improper resolution of path equivalence in WebDAV allows an authorized attacker to execute code over a network.