This vulnerability (CVE-2026-20849) affects Windows 10 Version 1607 (build 10.0.14393.0) and is categorized under CWE-807, which involves reliance on untrusted inputs in security decisions. Specifically, the Windows Kerberos authentication mechanism improperly trusts input data, enabling an authorized attacker to elevate privileges remotely over a network. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The vulnerability is publicly known and a patch is available from Microsoft.

An authorized attacker can exploit this vulnerability remotely to elevate privileges on the affected Windows 10 Version 1607 system. Successful exploitation compromises confidentiality, integrity, and availability of the system. There are no reports of active exploitation in the wild currently.

A patch is available for this vulnerability. It is recommended to apply the official Microsoft update for Windows 10 Version 1607 to remediate this issue. Since this is not a cloud service, remediation depends on applying the patch on affected systems. No additional vendor advisory content is provided, so check Microsoft’s official security update channels for the latest patch information.