Advisory · CVE-2026-102217
Path equivalence flaw in Windows WebDAV can elevate privileges
Windows WebDAV improperly resolves path equivalence, which an authorized attacker can use to elevate privileges over the network. Microsoft rates it CVSS 3.1 8.8.
- Vendor
- Microsoft
- Product
- Windows WebDAV
- Identifier / CWE
- CVE-2026-102217
CWE-41 - Action timing
- Immediate
Explain it like I’m five
Two spellings of the same path are not treated as the same path, and the difference is enough to climb.
- 01Attacker engages the component
A remote or authorized attacker sends crafted content or requests to Windows WebDAV.
- 02Weakness triggers
The component mishandles the input and the flaw takes effect.
- 03Impact lands
The attacker gains the execution, elevation, or access the flaw allows.
What happened
Microsoft disclosed CVE-2026-102217 in its October 2026 update guide: improper handling of path equivalence (CWE-41) in Windows WebDAV lets an authorized attacker elevate privileges over the network.
Microsoft lists the affected releases and their patched build thresholds in its update guide. Apply the October 2026 security updates for your release rather than relying on a version guess here.
What to do
- Inventory every Windows WebDAV deployment, including test, training, and individually managed instances.
- Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
- Restrict network access to Windows WebDAV while remediation is underway, especially for internet-facing instances.
- Review application and server logs for WebDAV requests with unusual path spellings and privilege changes tied to WebDAV-enabled shares.
- Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
- Verify the deployed version or patch level after remediation.
Management note
Path canonicalization bugs are old, reliable, and worth patching without debate. Check where WebDAV is even enabled.