{"id":"CVE-2026-88224","kind":"vulnerability","aliases":["CVE-2026-88224"],"related":[],"title":"Windows AppX Deployment Service: link following lets a local user gain privileges","description":"Improper link resolution before file access ('link following') in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally.","summary":"A flaw in the Windows AppX Deployment Service lets an attacker with a local account follow a symbolic link before the service accesses a file. The result is that an authorized local user can elevate their privileges on the machine.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","local-accounts","windows"],"not_affected_if":["no-untrusted-local-users","single-user-machine"],"how_to_check":"- Check the installed Windows build with `winver` and compare it against the fixed build in Microsoft's advisory for CVE-2026-88224","fix":null,"status":"open","published_at":"2026-11-10T19:21:30+00:00","first_seen_at":"2026-11-10T19:25:19+00:00","triaged_at":"2026-11-10T19:50:03+00:00","updated_at":"2026-11-10T19:50:03+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:50:03Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows AppX Deployment Service: link following lets a local user gain privileges","impact":"high","summary":"A flaw in the Windows AppX Deployment Service lets an attacker with a local account follow a symbolic link before the service accesses a file. The result is that an authorized local user can elevate their privileges on the machine.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","local-accounts"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains elevated privileges on the Windows machine","analyst_note":"Find the affected Windows builds and the Microsoft patch for CVE-2026-88224 in the MSRC advisory; the NVD entry does not list them.","how_to_check":"- Check the installed Windows build with `winver` and compare it against the fixed build in Microsoft's advisory for CVE-2026-88224\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["single-user-machine","no-untrusted-local-users"],"who_is_affected":"Windows machines where users have a local account can be affected, since the attacker must already be authorized on the system. Servers and workstations with multiple local or shared users are the main concern. Systems where only one trusted user logs in are lower risk. The sources do not name the affected Windows builds.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000706,"input_tokens":4494,"output_tokens":514,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find the affected Windows builds and the Microsoft patch for CVE-2026-88224 in the MSRC advisory; the NVD entry does not list them.","search":"'-2026':14A,17A '-88224':15A,18A 'access':46B,69C 'account':22B,38B 'allow':77C 'appx':2A,29B,74C 'attack':34B,80C 'author':54B,79C 'cve':13A,16A 'deploy':3A,30B,75C 'elev':58B,82C 'file':48B,68C 'flaw':25B 'follow':6A,39B,71C 'gain':11A 'improp':64C 'infrastructur':19B 'let':7A,32B 'link':5A,42B,65C,70C 'local':9A,21B,37B,55B,84C 'local-account':20B 'machin':63B 'privileg':12A,60B,83C 'resolut':66C 'result':50B 'servic':4A,31B,45B,76C 'symbol':41B 'user':10A,56B 'window':1A,23B,28B,73C","nicknames":[],"mitigations":[],"who_affected":"Windows machines where users have a local account can be affected, since the attacker must already be authorized on the system. Servers and workstations with multiple local or shared users are the main concern. Systems where only one trusted user logs in are lower risk. The sources do not name the affected Windows builds.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","localaccounts","windows"],"campaign_type":null,"search_a":"'-2026':14A,17A '-88224':15A,18A 'appx':2A 'cve':13A,16A 'deploy':3A 'follow':6A 'gain':11A 'let':7A 'link':5A 'local':9A 'privileg':12A 'servic':4A 'user':10A 'window':1A","search_b":"'access':46B 'account':22B,38B 'appx':29B 'attack':34B 'author':54B 'deploy':30B 'elev':58B 'file':48B 'flaw':25B 'follow':39B 'infrastructur':19B 'let':32B 'link':42B 'local':21B,37B,55B 'local-account':20B 'machin':63B 'privileg':60B 'result':50B 'servic':31B,45B 'symbol':41B 'user':56B 'window':23B,28B","search_c":"'access':69C 'allow':77C 'appx':74C 'attack':80C 'author':79C 'deploy':75C 'elev':82C 'file':68C 'follow':71C 'improp':64C 'link':65C,70C 'local':84C 'privileg':83C 'resolut':66C 'servic':76C 'window':73C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:30+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-88224","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88224","severity":null,"published_at":"2026-11-10T19:21:30+00:00","modified_at":"2026-11-10T19:21:30+00:00","first_seen_at":"2026-11-10T19:25:19+00:00","fetched_at":"2026-11-10T19:25:19+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}