{"id":"CVE-2026-95963","kind":"vulnerability","aliases":["CVE-2026-95963"],"related":[],"title":"Windows Data Sharing Service Client: link following lets a local user gain SYSTEM-level privileges","description":"Improper link resolution before file access ('link following') in Data Sharing Service Client allows an authorized attacker to elevate privileges locally.","summary":"Microsoft Windows Data Sharing Service Client follows links before accessing a file (CWE-59). A local user with low privileges can elevate privileges. Microsoft rated it CVSS 7.8; no exploitation or public PoC known as of 10 Nov 2026.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 10 1607","fixed":["10.0.14393.9688"],"affected":">=10.0.14393.0, <10.0.14393.9688","ecosystem":"microsoft"},{"name":"Windows 10 1809","fixed":["10.0.17763.9487"],"affected":">=10.0.17763.0, <10.0.17763.9487","ecosystem":"microsoft"},{"name":"Windows 10 21H2","fixed":["10.0.19044.7846"],"affected":">=10.0.19044.0, <10.0.19044.7846","ecosystem":"microsoft"},{"name":"Windows 10 22H2","fixed":["10.0.19045.7846"],"affected":">=10.0.19045.0, <10.0.19045.7846","ecosystem":"microsoft"},{"name":"Windows 11 23H2","fixed":["10.0.22631.7711"],"affected":">=10.0.22631.0, <10.0.22631.7711","ecosystem":"microsoft"}],"ecosystems":[],"tags":["data-sharing-service-client","local-privilege-escalation","microsoft","other","windows"],"not_affected_if":["no-local-users","unknown"],"how_to_check":"Run winver or [Environment]::OSVersion in PowerShell and compare the build to the fixed builds listed in the fix field; any lower build is exposed. Check the MSRC page for the full product list (OffSeq shows only part of it).","fix":"Install the November 2026 Windows cumulative update: Windows 10 1607 build 10.0.14393.9688, 1809 10.0.17763.9487, 21H2 10.0.19044.7846, 22H2 10.0.19045.7846, Windows 11 23H2 10.0.22631.7711 (per OffSeq's copy of the CVE record; the MSRC page could not be read, and OffSeq truncates the list, +8 more products).","status":"open","published_at":"2026-11-10T19:21:52+00:00","first_seen_at":"2026-11-10T19:25:25+00:00","triaged_at":"2026-11-10T19:38:08+00:00","updated_at":"2026-11-10T20:18:45+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-10T19:38:08Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Data Sharing Service Client: link following lets a local user gain privileges","impact":"high","summary":"The Data Sharing Service Client resolves a file path as a link before accessing the file, so a flaw in how it handles links can be abused. An authorized local attacker can use this to elevate their privileges on the machine.","audience":"businesses","category":"other","nicknames":[],"who_cares":["data-sharing-service-client","local-privilege-escalation"],"confidence":0.4,"fix_status":"unknown","needs_auth":"yes","worst_case":"local attacker gains elevated privileges on the machine","analyst_note":"Identify the vendor, affected and fixed versions, and default configuration of the Data Sharing Service Client from the NVD entry or vendor advisory.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Affected systems are machines where the Data Sharing Service Client is installed and where local users with some existing access could be present. The sources do not name the vendor, affected versions, or the default configuration, so the exact exposure is unknown.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000668,"input_tokens":4493,"output_tokens":437,"severity_before":"high"},"analyst_status":"done","analyst_note":"Identify the vendor, affected and fixed versions, and default configuration of the Data Sharing Service Client from the NVD entry or vendor advisory.","search":"'-2026':18A,21A '-59':63B '-95963':19A,22A '10':24A,27A,30A,33A,86B '11':36A '1607':25A '1809':28A '2026':88B '21h2':31A '22h2':34A '23h2':37A '7.8':77B 'access':59B,94C 'allow':102C 'attack':105C 'author':104C 'client':5A,42B,55B,101C 'cve':17A,20A 'cvss':76B 'cwe':62B 'data':2A,39B,52B,98C 'data-sharing-service-cli':38B 'elev':71B,107C 'escal':46B 'exploit':79B 'file':61B,93C 'follow':7A,56B,96C 'gain':12A 'improp':89C 'known':83B 'let':8A 'level':15A 'link':6A,57B,90C,95C 'local':10A,44B,65B,109C 'local-privilege-escal':43B 'low':68B 'microsoft':47B,50B,73B 'nov':87B 'poc':82B 'privileg':16A,45B,69B,72B,108C 'public':81B 'rate':74B 'resolut':91C 'servic':4A,41B,54B,100C 'share':3A,40B,53B,99C 'system':14A 'system-level':13A 'user':11A,66B 'window':1A,49B,51B 'windows':23A,26A,29A,32A,35A","nicknames":[],"mitigations":[],"who_affected":"Affected systems are machines where the Data Sharing Service Client is installed and where local users with some existing access could be present. The sources do not name the vendor, affected versions, or the default configuration, so the exact exposure is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["101607","101809","1021h2","1022h2","1123h2","windows101607","windows101809","windows1021h2","windows1022h2","windows1123h2"],"ptokens":["10","11","1607","1809","21h2","22h2","23h2","windows"],"labels":["datasharingserviceclient","high","localprivilegeescalation","microsoft","other","windows"],"campaign_type":null,"search_a":"'-2026':18A,21A '-95963':19A,22A '10':24A,27A,30A,33A '11':36A '1607':25A '1809':28A '21h2':31A '22h2':34A '23h2':37A 'client':5A 'cve':17A,20A 'data':2A 'follow':7A 'gain':12A 'let':8A 'level':15A 'link':6A 'local':10A 'privileg':16A 'servic':4A 'share':3A 'system':14A 'system-level':13A 'user':11A 'window':1A 'windows':23A,26A,29A,32A,35A","search_b":"'-59':63B '10':86B '2026':88B '7.8':77B 'access':59B 'client':42B,55B 'cvss':76B 'cwe':62B 'data':39B,52B 'data-sharing-service-cli':38B 'elev':71B 'escal':46B 'exploit':79B 'file':61B 'follow':56B 'known':83B 'link':57B 'local':44B,65B 'local-privilege-escal':43B 'low':68B 'microsoft':47B,50B,73B 'nov':87B 'poc':82B 'privileg':45B,69B,72B 'public':81B 'rate':74B 'servic':41B,54B 'share':40B,53B 'user':66B 'window':49B,51B","search_c":"'access':94C 'allow':102C 'attack':105C 'author':104C 'client':101C 'data':98C 'elev':107C 'file':93C 'follow':96C 'improp':89C 'link':90C,95C 'local':109C 'privileg':108C 'resolut':91C 'servic':100C 'share':99C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:52+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95963","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95963","severity":null,"published_at":"2026-11-10T19:21:52+00:00","modified_at":"2026-11-10T19:21:52+00:00","first_seen_at":"2026-11-10T19:25:25+00:00","fetched_at":"2026-11-10T19:25:25+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-95963:2639","url":"https://radar.offseq.com/threat/cve-2026-95963-cwe-59-link-following-in-microsoft-windows-10-version-1607-aa86d9a493734708","severity":null,"published_at":"2026-11-10T20:18:45+00:00","modified_at":"2026-11-10T20:18:45+00:00","first_seen_at":"2026-11-10T20:18:45+00:00","fetched_at":"2026-11-10T20:18:45+00:00","note":"Vendor is Microsoft (Windows component, CNA Microsoft). Versions come from the OffSeq mirror of the CVE record only; MSRC page was unreadable, so nothing is marked verified. Product list is truncated at the source (+8 more). Not exploited, no PoC.","cites":["https://radar.offseq.com/threat/cve-2026-95963-cwe-59-link-following-in-microsoft-windows-10-version-1607-aa86d9a493734708"]}],"documents":[{"id":118001,"url":"https://radar.offseq.com/threat/cve-2026-95963-cwe-59-link-following-in-microsoft-windows-10-version-1607-aa86d9a493734708","title":"OffSeq: CVE-2026-95963 Windows link following","kind":"other","source":"analyst","publisher":null,"text":"Affects Windows 10 1607/1809/21H2/22H2 and Windows 11 23H2 (list truncated, +8 more). Fixed builds 10.0.14393.9688, 10.0.17763.9487, 10.0.19044.7846, 10.0.19045.7846, 10.0.22631.7711. CVSS 7.8, not known exploited, no public PoC. CNA Microsoft.","published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}