CVE-2026-20931CWE-73

CVE-2026-20931

High · published January 13, 2026

CVSS v3.1
8.0
EPSS
1%
Percentile
57.6
In the wild
Unconfirmed
What it is

⚡ An authorized attacker can turn the tables with just a file name! This external control vulnerability in Windows Telephony Service opens the door to privilege elevation over adjacent networks. 🔥 Think of it like a hotel concierge who, instead of just checking you in, also reads your room number and gives themselves access to all the luxury suites — all because they got a little too friendly with the room keys! If exploited, this means an attacker could gain elevated privileges, potentially compromising sensitive information or systems on the adjacent network. The implications could be absolutely devastating, altering the landscape of your security posture dramatically!

Put simply

Think of it like a hotel concierge who, instead of just checking you in, also reads your room number and gives themselves access to all the luxury suites — all because they got a little too friendly with the room keys! This vulnerability allows an authorized user to control file names or paths, leading to unauthorized privilege escalation within the Windows Telephony Service. Essentially, it mismanages access controls, enabling escalation beyond intended permissions.

What to do

If exploited, this means an attacker could gain elevated privileges, potentially compromising sensitive information or systems on the adjacent network. The implications could be absolutely devastating, altering the landscape of your security posture dramatically! To mitigate this risk, ensure you apply the latest security updates from Microsoft. Additionally, review user permissions to limit access to necessary functions only. Be proactive and audit your network for any unauthorized configurations! You've got this! By taking these steps, you'll be one step closer to fortifying your defenses! 🛡️

The record
Technical detail
CVSS v3.1
8.0 · HIGH
Vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00845 · 57.6th percentile
Weakness
CWE-73 · External Control of File Name or Path
Published
2026-01-13T23:16Z
Affected products (19)
ProductVersionsFixed in
microsoft/windows_10_1607< 10.0.14393.878310.0.14393.8783
microsoft/windows_10_1607< 10.0.14393.878310.0.14393.8783
microsoft/windows_10_1809< 10.0.17763.827610.0.17763.8276
microsoft/windows_10_1809< 10.0.17763.827610.0.17763.8276
microsoft/windows_10_21h2< 10.0.19044.680910.0.19044.6809
microsoft/windows_10_22h2< 10.0.19045.680910.0.19045.6809
microsoft/windows_11_23h2< 10.0.22631.649110.0.22631.6491
microsoft/windows_11_24h2< 10.0.26100.762310.0.26100.7623
microsoft/windows_11_25h2< 10.0.26200.762310.0.26200.7623
microsoft/windows_server_2008all versions—
microsoft/windows_server_2008all versions—
microsoft/windows_server_2008all versions—
microsoft/windows_server_2012all versions—
microsoft/windows_server_2012all versions—
microsoft/windows_server_2016< 10.0.14393.878310.0.14393.8783
microsoft/windows_server_2019< 10.0.17763.827610.0.17763.8276
microsoft/windows_server_2022< 10.0.20348.464810.0.20348.4648
microsoft/windows_server_2022_23h2< 10.0.25398.209210.0.25398.2092
microsoft/windows_server_2025< 10.0.26100.3223010.0.26100.32230
References (3)
EPSS history
Timeline
  • 13 JAN 17:57Z
    Windows Telephony Service Elevation of Privilege Vulnerability
    cvelistv5