CVE-2026-57091

Windows File History Service Elevation of Privilege Vulnerability

No known exploitation. EPSS puts it in the 24th percentile. A vendor fix is available.

CVSS 3.17.8High EPSS percentile24th0.3% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-07-14Updated 2026-07-22Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check which of these systems you run: Windows 10, Windows 11, or Windows Server 2016/2019/2022/2025, and confirm they’re at the version levels shown in Microsoft’s CVE update page.
Install the Microsoft security update for CVE-2026-57091 as directed on the MSRC update guide.
Verify the update is fully applied (system restart if required) and that Windows Update shows the CVE-related patch as installed.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Stack-based buffer overflow in Windows File History Service allows an authorized attacker to elevate privileges locally.

In plain language

Written by AI from the record

CVE-2026-57091 is a Windows flaw that lets someone with limited access run code with much higher privileges; most small businesses should treat it as urgent because it can lead to full system takeover on affected Windows machines.

CVE-2026-57091 is a local stack-based buffer overflow in the Windows File History Service that allows an authorized attacker with low-level privileges to elevate to high/system control without any user interaction.

If you're affected

Full system takeover
Malware installation as admin
Ransomware-enabling access
Loss of business operations

What is it

This vulnerability is like a mistake in a built-in Windows feature (File History) that an attacker can exploit using limited access to “break out” into higher privileges. If that happens, the attacker can effectively control the whole computer as if they had admin-level power, without needing the user to click anything.

Who is affected

This matters if you use or manage Windows 10, Windows 11, or Windows Server 2016/2019/2022/2025, because the vulnerability is in a Windows service available on those systems. Exploitation requires an attacker to already have low-level access on the machine; it is not known to be reachable from a fully default, outside-the-network situation based on the provided information.

How urgent is it

This is RED because it can be used locally by an attacker who already has low-level access to gain full control, and the fix is available. Even though it requires some initial access, successfully exploiting it is a fast path to turning a limited foothold into admin-level takeover.

What to do — in detail

Inventory and identify affected machines

Create a quick list of all endpoints and servers running: Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows Server 2025.

Determine whether each machine is still before the fixed build

For each system, check its current Windows build/version.
Compare against Microsoft’s fixed versions for CVE-2026-57091:
- Windows 10: fixed in 10.0.14393.9339; 10.0.17763.9020; 10.0.19044.7548; 10.0.19045.7548
- Windows 11: fixed in 10.0.26100.8875; 10.0.28000.2525
- Windows Server 2016: fixed in 10.0.14393.9339
- Windows Server 2019: fixed in 10.0.17763.9020
- Windows Server 2022: fixed in 10.0.20348.5386
- Windows Server 2025: fixed in 10.0.26100.33158

Apply the patch

Install the Microsoft update for CVE-2026-57091 using the MSRC guidance: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57091.
Reboot if the update requires it and ensure Windows Update reports the update is installed.

If patching is delayed (temporary reduction of risk)

Focus on reducing the chance that an attacker ever gets low-level access locally:
- Review account access controls (least privilege for standard users/services).
- Tighten local admin rights and remove unnecessary users from privileged groups.
- Keep endpoint/server access routes (remote admin tools, management shares, exposed services) limited to trusted staff and networks.

What to monitor after updating

Look for signs of privilege escalation or unexpected admin-level activity around the time of patching.
Monitor endpoint logs and alerting for unusual process behavior related to Windows service activity.

KEV/CISA deadline

KEV listing: not listed in CISA KEV per the provided findings, so no KEV-driven due date is available from this dataset.

Technical context

Severity/impact: Local elevation of privilege with high consequences (the findings describe full control of the affected system after exploitation). Weakness: CWE-121 (stack-based buffer overflow). Mechanism: A stack-based buffer overflow in the Windows File History Service can be triggered by an attacker who already has low-level privileges; exploitation does not require user interaction. Exploitation status: KEV is not listed and there is no clear dated press claim of real-world exploitation in the provided findings; no public exploit code is recorded. Patch availability: Fixed builds are provided per OS/version via the MSRC update guide for CVE-2026-57091. What KEV means here: since it is not on the KEV list in the provided data, the dataset does not tie this CVE to CISA’s “known exploited” list, but the overall verdict remains RED due to the ability to turn limited local access into full system control.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS24th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.3% chance of exploitation activity in the next 30 days, which ranks it in the 24th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

11 events over 8 days, from the signal feeds we watch.

2026-07-22Patch availablerecord updated
2026-07-17Patch availablerecord updated
2026-07-16OpenVAS check addedrecord updated
2026-07-14Publishedweakness classified, att&ck mapped, record updated, record updated

Affected products

Microsoftcommercial · US

And 19 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Scored 7.8 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable