CVE-2026-83798

Analyzed Analyzed - Analysis Complete

Improper Cryptographic Signature Verification in Windows Update Stack

Publication date: 2026-10-13

Last updated on: 2026-10-27

Assigner: Microsoft Corporation

Description

Improper verification of cryptographic signature in Windows Update Stack allows an authorized attacker to perform spoofing locally.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-27

Generated

2026-11-08

AI Q&A

2026-10-13

EPSS Evaluated

2026-11-07

NVD

CVE-2026-83798

EUVD

EUVD-2026-99369

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	windows_server_2012	r2
microsoft	windows_server_2012	*
microsoft	windows_server_2022	to 10.0.20348.5761 (exc)
microsoft	windows_10_1607	to 10.0.14393.9612 (exc)
microsoft	windows_10_1607	to 10.0.14393.9612 (exc)
microsoft	windows_10_1809	to 10.0.17763.9376 (exc)
microsoft	windows_10_1809	to 10.0.17763.9376 (exc)
microsoft	windows_10_21h2	to 10.0.19044.7807 (exc)
microsoft	windows_10_21h2	to 10.0.19044.7807 (exc)
microsoft	windows_10_21h2	to 10.0.19044.7807 (exc)
microsoft	windows_11_23h2	to 10.0.22631.7652 (exc)
microsoft	windows_11_23h2	to 10.0.22631.7652 (exc)
microsoft	windows_11_24h2	to 10.0.26100.9711 (exc)
microsoft	windows_11_24h2	to 10.0.26100.9711 (exc)
microsoft	windows_11_25h2	to 10.0.26200.9711 (exc)
microsoft	windows_11_25h2	to 10.0.26200.9711 (exc)
microsoft	windows_11_26h1	to 10.0.28000.3231 (exc)
microsoft	windows_11_26h1	to 10.0.28000.3231 (exc)
microsoft	windows_11_26h2	to 10.0.26300.9711 (exc)
microsoft	windows_11_26h2	to 10.0.26300.9711 (exc)
microsoft	windows_server_2016	to 10.0.14393.9612 (exc)
microsoft	windows_server_2019	to 10.0.17763.9376 (exc)
microsoft	windows_server_2025	to 10.0.26100.33650 (exc)
microsoft	windows_10_22h2	to 10.0.19045.7807 (exc)
microsoft	windows_10_22h2	to 10.0.19045.7807 (exc)
microsoft	windows_10_22h2	to 10.0.19045.7807 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-347	The product does not verify, or incorrectly verifies, the cryptographic signature for data.
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

This vulnerability involves improper verification of cryptographic signatures in the Windows Update Stack. An authorized attacker could exploit this to perform spoofing attacks locally on affected systems.

Detection Guidance

This vulnerability involves improper cryptographic signature verification in the Windows Update Stack. Detection requires checking Windows Update logs and verifying update signatures. Use PowerShell commands like Get-WindowsUpdateLog to review update logs and Get-AuthenticodeSignature to check file signatures. Monitor for unexpected update installations or unauthorized modifications.

Impact Analysis

An attacker could impersonate legitimate updates or services, potentially installing malicious software or gaining unauthorized access to your system. This could lead to data breaches, system compromise, or further network infiltration.

Compliance Impact

This vulnerability allows local spoofing via improper cryptographic signature verification in Windows Update Stack. Such spoofing risks could undermine data integrity and authenticity controls required by GDPR and HIPAA, potentially leading to non-compliance if exploited to manipulate update sources or system integrity.

Mitigation Strategies

Apply the latest Windows security updates from Microsoft Update to patch the cryptographic signature verification flaw in the Windows Update Stack.

Hi! I’m here to help you understand CVE-2026-83798. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...