CVE-2026-83659 is a local privilege escalation vulnerability in Microsoft Windows 10 Version 1607 and related builds. It involves improper link resolution before file access in the Windows User Profile Service, allowing an authorized attacker to elevate privileges locally. The vulnerability has a high severity score of 7.8 and affects multiple Windows 10 versions prior to specific fixed builds. Microsoft has released official fixes for all affected versions.
CVE-2026-83507 is a vulnerability in the Windows Update Orchestrator Service of Microsoft Windows 10 Version 21H2 involving improper link resolution before file access, also known as 'link following'. This flaw allows an authorized attacker to locally disclose information. The vulnerability has a medium severity with a CVSS score of 5.5 and has been officially fixed in multiple Windows 10 builds.
CVE-2026-62687 is a vulnerability in the Windows Backup Engine of Microsoft Windows 10 Version 21H2. It involves improper link resolution before file access, known as 'link following,' which allows an authorized local attacker to disclose information. The issue affects multiple builds of Windows 10 21H2 and related versions. Microsoft has released official fixes for all affected versions. The vulnerability has a medium severity rating with a CVSS score of 5.5.
CVE-2026-70190 is a high-severity vulnerability in the Microsoft .NET 10.0 runtime involving improper link resolution before file access, known as 'link following'. This flaw allows an authorized local attacker to elevate privileges. The issue affects multiple versions of the .NET runtime prior to fixed releases. An official patch is available to remediate this vulnerability.
CVE-2026-70165 is a vulnerability in Microsoft .NET 10.0 runtime involving improper link resolution before file access, known as 'link following'. This flaw allows an authorized local attacker to elevate privileges. The issue affects multiple versions of the .NET runtime prior to specific fixed releases. A patch is available and has been officially released by Microsoft.
CVE-2026-85849 is a local privilege escalation vulnerability in the Windows AppX Deployment Service affecting multiple versions of Windows 10, including Version 1607. The flaw involves improper link resolution before file access (link following), which allows an authorized attacker to elevate privileges on the affected system. Microsoft has released official fixes for all affected versions.
CVE-2026-85343 is a vulnerability in Microsoft Windows 10 Version 1607 and related builds involving improper link resolution before file access in Windows Hyper-V. This flaw allows an authorized local attacker to elevate privileges by exploiting link following behavior. The vulnerability has a high severity with a CVSS score of 7.8 and has been officially fixed in multiple Windows 10 builds.
CVE-2026-83927 is a local privilege escalation vulnerability in Microsoft Windows 10 Version 21H2 caused by improper link resolution before file access in the Windows Registry. An authorized attacker can exploit this flaw to elevate privileges on the affected system. The vulnerability has a high severity rating with a CVSS score of 7.8. Official patches are available from Microsoft to address this issue.
CVE-2026-83793 is a local privilege escalation vulnerability in the Windows Update Orchestrator Service on Windows 10 Version 21H2. It involves improper link resolution before file access, also known as 'link following', which allows an authorized attacker to elevate privileges locally. The vulnerability affects multiple Windows 10 builds prior to specific fixed versions. A patch is available from Microsoft to address this issue.
CVE-2026-83704 is a local privilege escalation vulnerability in the Microsoft Windows Search Component affecting Windows 10 Version 1607 and other versions. It involves improper link resolution before file access ('link following'), allowing an authorized attacker to elevate privileges locally. The vulnerability has a high severity with a CVSS score of 7.8. Fixed versions are available, and Microsoft has issued an official fix.
CVE-2026-69673 is a high-severity vulnerability in Microsoft Windows 11 version 23H2 involving improper link resolution before file access, known as 'link following', in the Windows Update component. This flaw allows an authorized local attacker to elevate privileges. The issue affects multiple builds of Windows 11 23H2 prior to specific fixed versions. Microsoft has released official fixes for all affected versions.
CVE-2026-69969 is a medium severity vulnerability in the Windows AppX Deployment Service of Microsoft Windows 10 Version 21H2. It involves improper link resolution before file access, also known as 'link following,' which can allow an authorized attacker to disclose information locally. The vulnerability affects multiple builds of Windows 10 Version 21H2 and related versions prior to specific fixed releases. An official fix is available from Microsoft.
CVE-2026-53562 is a high-severity vulnerability in Citrix UniconOS involving improper link resolution before file access, also known as 'link following'. This flaw affects UniconOS versions before 2607 CR and before 2603 LTSR CU2. It allows an attacker with limited privileges to potentially manipulate file access due to incorrect handling of symbolic links. The vulnerability has a CVSS 4.0 score of 8.5, indicating a significant risk. No known exploits are reported in the wild, and no patch links are provided in the data. The product is not a cloud service, so remediation depends on vendor advisories. The affectedVersions field in the input is not clearly stated beyond an invalid placeholder (=0), so no canonical affected versions can be confirmed from the data.
### Impact
ACL checks ran on the lexical vault-relative path while containment used the realpath. An in-vault symlink placed under an allowed glob, whose realpath resolved into a denied folder, passed the read ACL — an intra-vault read-ACL-scope bypass. It requires an out-of-band-planted symlink (no MCP tool creates one) and is not a vault-root escape.
### Patches
Fixed in **1.3.1**. Upgrade to `>= 1.3.1`. ACL enforcement now derives the realpath vault-relative path and feeds a single unified predicate at every site.
### Workarounds
Do not permit untrusted symlinks inside the vault.
ImageMagick versions before 7.1.2-32 have a time-of-check time-of-use (TOCTOU) symlink race vulnerability. This flaw allows an attacker to bypass the path security policy by swapping a checked file path with a symbolic link during script execution, potentially enabling unauthorized file reads that the security policy is designed to prevent.
CVE-2026-107810 is a high-severity vulnerability in 0xJacky's nginx-ui versions from 2.0.0 up to but not including 2.5.0. It involves improper link resolution before file access in the backup and restore functionality, allowing an authenticated user with backup creation and restoration privileges to inject malicious symlinks. This can lead to persistent configuration injection or denial of service. The issue is fixed in version 2.5.0.
Banks generates meaningful LLM prompts using a simple template language. Prior to 2.5.1, Banks DirectoryPromptRegistry does not reject symbolic links for index.json or discovered and existing .jinja prompt files. In an application where untrusted users can influence a prompt directory, DirectoryPromptRegistry._scan() and DirectoryPromptRegistry.get() can follow a link outside the registry root and disclose a file, while DirectoryPromptRegistry.set(), DirectoryPromptRegistry._save(), and DirectoryPromptRegistry._load() can read or overwrite an external link target. The issue requires attacker influence over the registry directory or its extracted contents. This issue is fixed in version 2.5.1.
CVE-2026-107608 is a vulnerability in AWS aws-cdk-lib before version 2.267.0 involving improper link resolution before file access during asset bundling output handling. This flaw might allow an actor with certain context-dependent capabilities to cause files from the build host to be published as deployed assets. AWS has fixed this issue in version 2.267.0.
Improper link resolution and external control of file paths in the administrative command-line operations of hMailServer.exe in Progressive Robot hMailServer 6.3.4 and 6.3.5 allow a local attacker who already runs code as the low-privilege service account to escalate privilege. On Windows, operations run with administrator rights by the installer, DBSetup, the Control Panel or an administrator wrote log entries and crash records into the log folder, created, deleted and changed the permissions of the self-signed certificate and private key in the data folder, and rewrote message files in the data folder, all by path in folders the service account (NT SERVICE\hMailServer, the default for new installations since 6.3.4) can modify, following junctions and mount points; and the store-maintenance operations reached files by names taken from the database, which the service account can write, including names outside the data folder. On Linux, the store-maintenance and object-storage operations run as root followed symbolic links the service account (the packaged hmailserver user, which owns the data folder) planted in it, so a root-run operation read, wrote or removed the link's target as root. A local attacker controlling the service account can thereby gain the administrator's (Windows) or root's (Linux) privileges when such an operation is run.