CVE-2026-70184
Awaiting Analysis
Awaiting Analysis - Queue
Improper Path Resolution in Windows Backup Engine Elevates Privileges
Vulnerability report for CVE-2026-70184, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-13
Last updated on: 2026-10-13
Assigner: Microsoft Corporation
Description
Description
Improper resolution of path equivalence in Windows Backup Engine allows an authorized attacker to elevate privileges locally.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Microsoft | Windows | 10 Version 21H2 10.0.19044.0 |
| Microsoft | Windows | 10 Version 22H2 10.0.19045.0 |
| Microsoft | Windows | 11 version 23H2 10.0.22631.0 |
| Microsoft | Windows | 11 Version 23H2 10.0.22631.0 |
| Microsoft | Windows | 11 Version 24H2 10.0.26100.0 |
| Microsoft | Windows | 11 Version 25H2 10.0.26200.0 |
| Microsoft | Windows | 11 version 26H1 10.0.28000.0 |
| Microsoft | Windows | 11 Version 26H2 10.0.26300.0 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-41 | The product is vulnerable to file system contents disclosure through path equivalence. Path equivalence involves the use of special characters in file and directory names. The associated manipulations are intended to generate multiple names for the same object. |
