This vulnerability (CVE-2026-20929) affects Windows 10 Version 1607 (build 10.0.14393.0) and is caused by improper access control in the Windows HTTP.sys driver. It enables an attacker with some level of authorization to escalate privileges remotely via network access. The CVSS v3.1 base score is 7.5, indicating high severity, with attack vector network, high complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. Microsoft has released an official fix for this vulnerability as documented in their security update guide.

Successful exploitation allows an authorized attacker to elevate their privileges remotely over the network, potentially gaining higher system privileges than intended. This can lead to full compromise of the affected system's confidentiality, integrity, and availability.

An official fix is available from Microsoft and should be applied promptly. Refer to the Microsoft security update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20929 for the patch and remediation instructions.