CVE-2026-88162: CWE-863: Incorrect Authorization in Microsoft Windows 10 Version 1607

This vulnerability, identified as CWE-863 (Incorrect Authorization), exists in the Windows Encrypting File System (EFS) component of Windows 10 Version 1607. It allows an authorized local attacker with limited privileges to tamper with EFS-protected data due to improper authorization checks. The CVSS 3.1 base score is 5.5, reflecting a medium severity with local attack vector, low complexity, and no user interaction required. The vulnerability affects multiple Windows 10 builds starting from 10.0.14393.0 up to but not including various later build versions where patches have been applied. Microsoft has issued an official fix for this vulnerability.

The vulnerability allows an authorized local attacker to tamper with data protected by the Windows Encrypting File System, impacting data integrity. There is no impact on confidentiality or availability. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for the affected Windows 10 versions as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88162. No additional mitigation steps are indicated by the vendor.