CVE-2026-108135: Windows Backup Engine Elevation of Privilege Vulnerability
Improper link resolution before file access ('link following') in Windows Backup Engine allows an authorized attacker to elevate privileges locally.
Other sources
Windows Backup Engine Elevation of Privilege Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.22631.7652Patch KB5126653 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26300.9711Patch KB5127648 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.28000.3231Patch KB5127646 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26200.9711Patch KB5127648 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26100.9711Patch KB5127648 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.19044.7807Patch KB5126657
Event History
Frequently Asked Questions
Can this be exploited remotely?
The available vector is local only. An attacker would need access to the affected system rather than being able to exploit it over the network.
What level of access does an attacker need?
The attacker must already be authorized with low privileges on the system. No user interaction is required, but exploitation has high attack complexity.
Which systems should be included in triage?
Review deployments of Microsoft Windows 10, Microsoft Windows 11, and Microsoft Windows Backup Engine listed for this CVE.