CVE-2026-70563: CWE-59: Improper Link Resolution Before File Access ('Link Following') in Microsoft Windows 10 Version 1607

CVE-2026-70563 is a vulnerability classified under CWE-59 (Improper Link Resolution Before File Access, also known as 'link following') affecting Microsoft Windows 10 Version 1607 and other related versions. The flaw exists in the Windows Shell component, where improper handling of symbolic links or shortcuts can be exploited by an attacker to conduct spoofing attacks remotely. This vulnerability has a CVSS 3.1 base score of 8.1, indicating high severity, with network attack vector, low attack complexity, no privileges required, and user interaction needed. The impact includes high confidentiality and integrity impact without availability impact. Microsoft has released an official fix for this vulnerability.

An attacker can exploit this vulnerability remotely over a network without privileges but requires user interaction to perform spoofing attacks, potentially leading to unauthorized disclosure and modification of information. There is no impact on system availability. The vulnerability affects confidentiality and integrity of the system.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for the affected Windows 10 versions as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70563. No additional mitigation actions are required beyond applying the official patch.