PULSEUnderground Intel

EN VIVO34señales / 24h

FEED

ransomqilin reclama a Segres Systec · ES · Technologyransomqilin reclama a Shield Wall Systems of Florida · US · Government & Defenseransomqilin reclama a The Excalibur Group · US · Otherransomiah6477 reclama a hilmar-cheese · US · Agriculture and Food Productionransomn0n reclama a Company #70 · EG · Not Foundransomn0n reclama a Company #73 · Not Foundransomlockbit5 reclama a torcivialaw.com · IT · Professional Servicesransomlockbit5 reclama a kidzrkooldental.com · US · Healthcareransomlockbit5 reclama a lcww.com.eg · EG · Not Foundransomlockbit5 reclama a neweramachines.com · US · Manufacturingransomlockbit5 reclama a grupoabg.com · MX · Manufacturingransomqilin reclama a KD Corp · KR · Not Foundransomakira reclama a Videk · GB · Technologyransomakira reclama a Boyle, Pecharich, Cline, Whittington and Stallings · Professional Servicesransomqilin reclama a Segres Systec · ES · Technologyransomqilin reclama a Shield Wall Systems of Florida · US · Government & Defenseransomqilin reclama a The Excalibur Group · US · Otherransomiah6477 reclama a hilmar-cheese · US · Agriculture and Food Productionransomn0n reclama a Company #70 · EG · Not Foundransomn0n reclama a Company #73 · Not Foundransomlockbit5 reclama a torcivialaw.com · IT · Professional Servicesransomlockbit5 reclama a kidzrkooldental.com · US · Healthcareransomlockbit5 reclama a lcww.com.eg · EG · Not Foundransomlockbit5 reclama a neweramachines.com · US · Manufacturingransomlockbit5 reclama a grupoabg.com · MX · Manufacturingransomqilin reclama a KD Corp · KR · Not Foundransomakira reclama a Videk · GB · Technologyransomakira reclama a Boyle, Pecharich, Cline, Whittington and Stallings · Professional Services

← Todos los CVEs

CVE Watch13 oct 2026

CVE-2026-83499

Insufficient granularity of access control in Windows Server Update Service allows an authorized attacker to elevate privileges locally.

CVSS

7.8

Alto

EPSS

0.3%

p22

KEV

—

Exploit Today

6

0-100

Publicado: 13 oct 2026 · Última mod.: 13 oct 2026 · CWE-1220

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

Insufficient granularity of access control in Windows Server Update Service allows an authorized attacker to elevate privileges locally.

Referencias oficiales

msrc.microsoft.comhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83499

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-103509—

———P4 Search (formerly Helix Search) returns stored credentials in cleartext through its configuration API to users with administrative privileges on the connected P4 Server, allowing privilege escalation. This affects 2026.4.2 and earlier and is fixed in 2026.4.3.5h CVE-2026-78433—

——0Gitea's web attachment handler skips its cross-repository ownership check for attachments created before 16 January 2026 and checks permissions against the repository named in the request URL instead. An unauthenticated attacker who knows a private attachment's UUID can request it through a public repository's attachment path and retrieve its contents. This can expose issue and pull request attachments or release assets; the random attachment UUID must already be known to the attacker.1d CVE-2026-819697.8 ALT

——6Insufficient granularity of access control in Windows Server Update Service allows an authorized attacker to elevate privileges locally.2d CVE-2026-702187.8 ALT

——7Insufficient granularity of access control in Windows StateRepository API allows an authorized attacker to elevate privileges locally.2d CVE-2026-702165.5 MED

——7Insufficient granularity of access control in Windows Mobile Device Management allows an authorized attacker to perform tampering locally.2d CVE-2026-932946.3 MED

——5A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to that identity.2d