CVE-2026-83999: Windows 11 24H2 Privilege Escalation Flaw

CVE-2026-83999 Overview

CVE-2026-83999 is an elevation of privilege vulnerability in the Windows Resilient File System (ReFS) Deduplication Service. The flaw stems from improper link resolution before file access, classified as [CWE-59] link following. An authorized local attacker can abuse the service to operate on files through attacker-controlled links, elevating privileges on the affected host. Microsoft has published an advisory for the issue and rates it as HIGH severity. The vulnerability affects current Windows 11 releases and Windows Server 2025.

Critical Impact
A local, authenticated attacker who wins a race condition against the ReFS Deduplication Service can escalate to higher privileges, compromising confidentiality, integrity, and availability of the host.

Affected Products

Microsoft Windows 11 24H2 (x64, ARM64)
Microsoft Windows 11 25H2 (x64, ARM64)
Microsoft Windows 11 26H1 (x64, ARM64)
Microsoft Windows Server 2025

Discovery Timeline

2026-09-08 - CVE-2026-83999 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-83999

Vulnerability Analysis

The Windows ReFS Deduplication Service performs file operations on behalf of the operating system while running with elevated privileges. The vulnerability arises when the service resolves file paths without adequately validating whether path components are symbolic links, junctions, or hard links. An attacker who can influence the paths the service touches can redirect operations to files the attacker could not otherwise modify. Successful exploitation yields code execution or file modification in a higher-privileged context. The EPSS probability currently sits at 0.21%, reflecting the local attack requirement and high attack complexity.

Root Cause

The root cause is a link-following weakness [CWE-59]. The ReFS Deduplication Service accesses file objects by path before verifying that intermediate components are not attacker-controlled reparse points. This is a classic time-of-check to time-of-use pattern where the service trusts the resolved path at the moment of access rather than opening the target with reparse-point protections such as FILE_FLAG_OPEN_REPARSE_POINT or verifying the final canonical path.

Attack Vector

Exploitation requires local access and low-level privileges on the target host. The attacker plants a symbolic link, junction, or hard link in a filesystem location that the ReFS Deduplication Service will later process. When the service accesses the crafted path, it follows the link into a sensitive target file, performing a privileged read, write, or delete on the attacker's behalf. The attack complexity is high because it depends on winning a race with the deduplication scan cycle and controlling filesystem layout at the right moment.

No public proof-of-concept exploit is available. See the Microsoft CVE-2026-83999 Advisory for vendor technical details.

Detection Methods for CVE-2026-83999

Indicators of Compromise

Unexpected creation of symbolic links, junctions, or hard links in directories scanned by the ReFS Deduplication Service, particularly by non-administrative processes.
Privileged file writes or deletions performed by the ReFS Deduplication Service targeting paths outside expected deduplication scopes.
New or modified files owned by SYSTEM in user-writable directories following deduplication activity.

Detection Strategies

Monitor Windows Security event IDs 4656, 4663, and 4670 for file access and permission changes performed by the ReFS Deduplication Service on unexpected paths.
Enable object access auditing on ReFS volumes and alert when the service accesses files traversed through reparse points.
Correlate low-privileged process activity that creates reparse points with subsequent privileged access from svchost.exe hosting the deduplication service.

Monitoring Recommendations

Track process lineage for the ReFS Deduplication Service and flag any child processes running as SYSTEM.
Baseline normal deduplication scan paths and alert on deviations that touch user profile directories, temp folders, or program data.
Ingest endpoint telemetry into a centralized data lake to hunt for link-following patterns across the fleet at scale.

How to Mitigate CVE-2026-83999

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-83999 Advisory to all affected Windows 11 and Windows Server 2025 systems.
Prioritize patching on multi-user hosts, terminal servers, and systems where untrusted users hold local accounts.
Audit local account membership and remove unnecessary interactive logon rights to reduce the exploitable population.

Patch Information

Microsoft has released fixes for Windows 11 24H2, 25H2, 26H1, and Windows Server 2025. Deploy the corresponding cumulative update through Windows Update, Windows Server Update Services, or your enterprise patch management platform. Confirm patch installation by verifying build numbers against the Microsoft advisory after reboot.

Workarounds

Where the Data Deduplication role is not required on ReFS volumes, disable the ReFS Deduplication Service to remove the attack surface until patches are applied.
Restrict the ability of standard users to create symbolic links by reviewing the SeCreateSymbolicLinkPrivilege assignment through Group Policy.
Limit local logon rights on servers running deduplication workloads to trusted administrative accounts only.

bash

# Review symbolic link creation privilege assignment
secedit /export /cfg C:\secpol.cfg
findstr /I "SeCreateSymbolicLinkPrivilege" C:\secpol.cfg

# Check ReFS Deduplication Service state
Get-Service -Name "Dedup*"

# Verify installed cumulative update after patching
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 5