CVE-2026-108135
Windows Backup Engine Elevation of Privilege Vulnerability
Published Oct 13, 2026 · updated Oct 14, 2026 · Microsoft Windows 10 Version 21H2
Improper link resolution before file access ('link following') in Windows Backup Engine allows an authorized attacker to elevate privileges locally.
Timeline
Detection, updates, and resolution for this record.
Oct 13, 2026 · CIRCL Vulnerability Lookup
Detected
Improper link resolution before file access ('link following') in Windows Backup Engine allows an authorized attacker to elevate privileges locally.
Oct 14, 2026 · CIRCL Vulnerability Lookup
Updated
Improper link resolution before file access ('link following') in Windows Backup Engine allows an authorized attacker to elevate privileges locally.
Affected
- vendor Microsoft Windows 10 Version 21H2version unspecified
- vendor Microsoft Windows 10 Version 22H2version unspecified
- vendor Microsoft Windows 11 Version 23H2version unspecified
- vendor Microsoft Windows 11 Version 24H2version unspecified
- vendor Microsoft Windows 11 Version 25H2version unspecified
- vendor Microsoft Windows 11 Version 26H2version unspecified
- vendor Microsoft Windows 11 version 23H2version unspecified
- vendor Microsoft Windows 11 version 26H1version unspecified
Sources
- CIRCL Vulnerability LookupCVE-2026-108135
Improper link resolution before file access ('link following') in Windows Backup Engine allows an authorized attacker to elevate privileges locally.
vulnerability.circl.lu - CVE.orgCVE-2026-108135
Official CVE identifier
cve.org - FIRST EPSSCVE-2026-108135
30-day exploitation probability 0.3%
first.org