PULSEUnderground Intel

LIVE35signals / 24h

FEED

ransomwallstreet reclama a TGM Manufacturing, Inc · US · Manufacturingransomqilin reclama a Segres Systec · ES · Technologyransomqilin reclama a Shield Wall Systems of Florida · US · Government & Defenseransomqilin reclama a The Excalibur Group · US · Otherransomiah6477 reclama a hilmar-cheese · US · Agriculture and Food Productionransomn0n reclama a Company #70 · EG · Not Foundransomn0n reclama a Company #73 · Not Foundransomlockbit5 reclama a torcivialaw.com · IT · Professional Servicesransomlockbit5 reclama a kidzrkooldental.com · US · Healthcareransomlockbit5 reclama a lcww.com.eg · EG · Not Foundransomlockbit5 reclama a neweramachines.com · US · Manufacturingransomlockbit5 reclama a grupoabg.com · MX · Manufacturingransomqilin reclama a KD Corp · KR · Not Foundransomakira reclama a Videk · GB · Technologyransomwallstreet reclama a TGM Manufacturing, Inc · US · Manufacturingransomqilin reclama a Segres Systec · ES · Technologyransomqilin reclama a Shield Wall Systems of Florida · US · Government & Defenseransomqilin reclama a The Excalibur Group · US · Otherransomiah6477 reclama a hilmar-cheese · US · Agriculture and Food Productionransomn0n reclama a Company #70 · EG · Not Foundransomn0n reclama a Company #73 · Not Foundransomlockbit5 reclama a torcivialaw.com · IT · Professional Servicesransomlockbit5 reclama a kidzrkooldental.com · US · Healthcareransomlockbit5 reclama a lcww.com.eg · EG · Not Foundransomlockbit5 reclama a neweramachines.com · US · Manufacturingransomlockbit5 reclama a grupoabg.com · MX · Manufacturingransomqilin reclama a KD Corp · KR · Not Foundransomakira reclama a Videk · GB · Technology

CVE WatchOct 13, 2026

CVE-2026-83499

Insufficient granularity of access control in Windows Server Update Service allows an authorized attacker to elevate privileges locally.

CVSS

7.8

High

EPSS

0.3%

p22

KEV

—

Exploit Today

6

0-100

Published: Oct 13, 2026 · Last modified: Oct 13, 2026 · CWE-1220

EPSS · 30d

Not enough EPSS history yet.

Technical description

Insufficient granularity of access control in Windows Server Update Service allows an authorized attacker to elevate privileges locally.

Official references

msrc.microsoft.comhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83499

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-103509—

———P4 Search (formerly Helix Search) returns stored credentials in cleartext through its configuration API to users with administrative privileges on the connected P4 Server, allowing privilege escalation. This affects 2026.4.2 and earlier and is fixed in 2026.4.3.6h CVE-2026-78433—

——0Gitea's web attachment handler skips its cross-repository ownership check for attachments created before 16 January 2026 and checks permissions against the repository named in the request URL instead. An unauthenticated attacker who knows a private attachment's UUID can request it through a public repository's attachment path and retrieve its contents. This can expose issue and pull request attachments or release assets; the random attachment UUID must already be known to the attacker.1d CVE-2026-819697.8 HIG

——6Insufficient granularity of access control in Windows Server Update Service allows an authorized attacker to elevate privileges locally.2d CVE-2026-702187.8 HIG

——7Insufficient granularity of access control in Windows StateRepository API allows an authorized attacker to elevate privileges locally.2d CVE-2026-702165.5 MED

——7Insufficient granularity of access control in Windows Mobile Device Management allows an authorized attacker to perform tampering locally.2d CVE-2026-932946.3 MED

——5A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to that identity.2d