CVE-2026-88162 Microsoft CVE debrief

Who should care

Defenders should assess exposure and prioritize patching for affected Windows versions, especially in environments where EFS is used. This includes reviewing system configurations, applying patches, and verifying system integrity. Security teams should also monitor for suspicious activity and assess the potential impact on their organization's assets and data. Operators of affected systems should take immediate

Why it matters

CVE-2026-88162 is a medium-severity vulnerability in Windows Encrypting File System (EFS) that allows authorized attackers to perform tampering locally. Defenders should prioritize patching affected versions and assess exposure, especially in environments using EFS.

• Verify system integrity and monitor for suspicious activity
• Apply patches for affected Windows versions
• Assess exposure in environments using EFS

Technical summary

The vulnerability exists in Windows Encrypting File System (EFS) due to improper authorization, allowing an authorized attacker to perform tampering locally. Affected versions include Windows 10 Version 1607, Windows 10 Version 1809, Windows 10 Version 21H2, Windows 10 Version 22H2, Windows 11 version 23H2, Windows 11 Version 23H2, Windows 11 Version 24H2, Windows 11 Version 25H2, Windows 11 version 26H1, Windows 11 Version 26H2, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows Server 2025, and Windows Server 2025 (Server Core installation).

Defensive priority

Apply patches immediately for affected Windows versions, assess exposure, and verify system integrity.

Recommended defensive actions

• Apply patches for affected Windows versions
• Assess exposure and verify system integrity
• Monitor system logs for suspicious activity

Evidence notes

The CVE Program and NVD provide official records of the vulnerability. Microsoft offers a vendor advisory with patch information. The vulnerability has been publicly disclosed and patches are available. Additional details can be found in the official CVE record and vendor advisory. The CVE Program record provides source-provided CVE metadata, while the NVD offers official vulnerability details and assessments. The vendor advisory includes patch information and guidance on affected and

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.