Which Windows 10 and 11 builds face high-severity WebDAV privilege escalation risk?

The short version

• A high-severity flaw in WebDAV allows network-based privilege escalation for authorised attackers.
• The issue affects specific builds of Windows 10 versions 1607, 1809, 21H2, and 22H2.
• Windows 11 version 23H2 is also vulnerable if not updated to the specified build.

The details

Microsoft has published an advisory for CVE-2026-102217, describing a WebDAV elevation of privilege vulnerability. According to the National Vulnerability Database, this flaw carries a CVSS score of 8.8, placing it in the high severity category. The core issue involves improper resolution of path equivalence within the WebDAV component. This allows an attacker who is already authorised to elevate privileges over a network connection. The weakness is categorised under CWE-41 in the NVD record. This type of flaw typically exploits how the system interprets file or directory paths, potentially allowing access to restricted areas.

The context

The vulnerability affects a range of Windows operating systems still in support. According to the NVD record, Microsoft Windows 10 Version 1607 is affected before build 10.0.14393.9612. Windows 10 Version 1809 is vulnerable before build 10.0.17763.9376. Both Windows 10 Version 21H2 and Windows 10 Version 22H2 are affected before build 10.0.19044.7807. For newer systems, Microsoft Windows 11 version 23H2 is vulnerable before build 10.0.22631.7652. The NVD lists Windows 11 Version 23H2 with the same build threshold. Environments running these older builds remain exposed to the risk.

Next steps

Organisations should audit their Windows environments to identify affected builds. Teams must compare their current system versions against the thresholds listed in the NVD record. Any system running a build lower than the specified version for its respective Windows release is potentially vulnerable. Prioritise patching for systems where WebDAV services are active or exposed to internal networks. Verify that update processes are functioning correctly for all supported versions. Ensure that change management procedures accommodate the necessary updates to mitigate this high-severity risk.

What defenders should look for

Security operations teams should monitor for unusual privilege escalation events originating from WebDAV services. Check logs for authorised users attempting to access restricted paths or directories they should not reach. Look for unexpected changes in user permissions or group memberships following WebDAV interactions. Review network traffic for anomalous WebDAV requests that might indicate exploitation attempts. If suspicious activity is detected, isolate the affected systems immediately to prevent further privilege escalation. Investigate the scope of any compromised accounts and reset credentials as a precautionary measure.

What to do and how to stay safe: Microsoft

• Audit all Windows 10 and 11 systems to identify builds vulnerable to CVE-2026-102217.
• Apply available updates to reach the minimum secure build versions listed by Microsoft.
• Monitor WebDAV logs for unusual path traversal or privilege escalation attempts.
• Restrict WebDAV access to only authorised users and necessary network segments.

Step-by-step guide: How Virtual Patching Works: The Mechanics Behind Inline Protection

General security guidance from the Honeypot Daily newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-102217?

The National Vulnerability Database assigns a CVSS score of 8.8 to this vulnerability.

Which Windows versions are affected by this WebDAV flaw?

Windows 10 versions 1607, 1809, 21H2, 22H2, and Windows 11 version 23H2 are affected.

How can an attacker exploit this vulnerability?

An authorised attacker can exploit improper path resolution to elevate privileges over a network.