{"id":"CVE-2026-83759","published":"2026-10-13T19:20:22.380","lastModified":"2026-10-16T16:21:28.200","description":"Improper control of generation of code ('code injection') in Windows Encrypting File System (EFS) allows an authorized attacker to execute code over a network.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-94"],"vendors":[],"products":[],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83759","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability allows an authenticated attacker to inject malicious code into the Windows Encrypting File System (EFS), potentially enabling remote code execution. The flaw occurs when EFS improperly handles code generation, creating a path for attackers to execute arbitrary commands over the network.","exploitability":"Exploitation requires an authenticated user account with access to EFS functionality, making it moderately difficult but not highly complex to achieve, with the main precondition being network access to the target system.","blast_radius":"If exploited, this vulnerability could allow attackers to execute arbitrary code on affected Windows systems with high privileges, potentially leading to full system compromise and lateral movement across the network.","remediation":"Apply the latest Windows updates that include the EFS code injection fix, specifically targeting the Windows 10 22H2 and Windows 11 22H2 releases which contain the patched EFS implementation.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","efs","windows","privilege-escalation"],"model":"garnet-coder","analyzedAt":"2026-10-18T09:58:48.056Z"}}