This vulnerability (CVE-2026-26128) affects the SMB Server in Windows 10 Version 1607 (build 10.0.14393.0). It is classified under CWE-287 (Improper Authentication), where the SMB Server does not properly enforce authentication controls. This flaw enables an attacker with local authorized access to escalate privileges, potentially gaining higher system privileges than intended. The CVSS 3.1 vector indicates local attack vector with low attack complexity, requiring low privileges but no user interaction, and impacts confidentiality, integrity, and availability with high severity. Microsoft has published a patch to remediate this vulnerability.

An authorized local attacker can exploit this vulnerability to elevate their privileges on the affected Windows 10 system. This could lead to unauthorized access to sensitive information, modification of system settings, or disruption of system availability. The high CVSS score reflects the critical nature of the impact on confidentiality, integrity, and availability.

A patch is available from Microsoft to fix this vulnerability. It is recommended to apply the official update promptly to mitigate the risk. Since this is not a cloud service, remediation depends on applying the patch to affected systems. There are currently no known exploits in the wild, but timely patching is advised to prevent potential exploitation.