CVE-2026-83933: CWE-59: Improper Link Resolution Before File Access ('Link Following') in Microsoft Windows 10 Version 21H2

CVE-2026-83933 is a vulnerability classified as CWE-59 (Improper Link Resolution Before File Access, also known as 'Link Following') affecting the Windows Update Orchestrator Service in Windows 10 Version 21H2. An authorized attacker with local access can exploit this flaw to disclose information by leveraging improper handling of symbolic links or similar link types before file access. The CVSS v3.1 base score is 5.5, indicating medium severity, with attack vector local, low attack complexity, and requiring low privileges but no user interaction. Microsoft has published an official fix for this vulnerability.

The vulnerability allows an authorized local attacker to disclose sensitive information by exploiting improper link resolution in the Windows Update Orchestrator Service. There is no indication of impact on integrity or availability. No known exploits are reported in the wild.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for Windows 10 Version 21H2 as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83933. No additional mitigation actions are indicated by the vendor.