CVE-2026-20931
published 2026-01-13CVE-2026-20931: External control of file name or path in Windows Telephony Service allows an authorized attacker to elevate privileges over an adjacent network.
PriorityP278high8CVSS 3.1
AVAACLPRLUINSUCHIHAH
ITWVulnCheck KEV
Exploited in the wild
EPSS
0.75%
51.1th percentile
External control of file name or path in Windows Telephony Service allows an authorized attacker to elevate privileges over an adjacent network.
Affected
45 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | windows_10_1607 | < 10.0.14393.8783 | 10.0.14393.8783 |
| microsoft | windows_10_1809 | < 10.0.17763.8276 | 10.0.17763.8276 |
| microsoft | windows_10_21h2 | < 10.0.19044.6809 | 10.0.19044.6809 |
| microsoft | windows_10_22h2 | < 10.0.19045.6809 | 10.0.19045.6809 |
| microsoft | windows_10_version_1607 | >= 10.0.14393.0 < 10.0.14393.8783 | 10.0.14393.8783 |
| microsoft | windows_10_version_1809 | >= 10.0.17763.0 < 10.0.17763.8276 | 10.0.17763.8276 |
| microsoft | windows_10_version_21h2 | >= 10.0.19044.0 < 10.0.19044.6809 | 10.0.19044.6809 |
| microsoft | windows_10_version_22h2 | >= 10.0.19045.0 < 10.0.19045.6809 | 10.0.19045.6809 |
| microsoft | windows_11_23h2 | < 10.0.22631.6491 | 10.0.22631.6491 |
| microsoft | windows_11_24h2 | < 10.0.26100.7623 | 10.0.26100.7623 |
| microsoft | windows_11_25h2 | < 10.0.26200.7623 | 10.0.26200.7623 |
| microsoft | windows_11_version_22h3 | >= 10.0.22631.0 < 10.0.22631.6491 | 10.0.22631.6491 |
| microsoft | windows_11_version_23h2 | >= 10.0.22631.0 < 10.0.22631.6491 | 10.0.22631.6491 |
| microsoft | windows_11_version_24h2 | >= 10.0.26100.0 < 10.0.26100.7623 | 10.0.26100.7623 |
| microsoft | windows_11_version_25h2 | >= 10.0.26200.0 < 10.0.26200.7623 | 10.0.26200.7623 |
| microsoft | windows_server_2008 | — | — |
| microsoft | windows_server_2008_r2_service_pack_1 | >= 6.1.7601.0 < 6.1.7601.28117 | 6.1.7601.28117 |
| microsoft | windows_server_2008_service_pack_2 | >= 6.0.6003.0 < 6.0.6003.23717 | 6.0.6003.23717 |
| microsoft | windows_server_2012 | — | — |
| microsoft | windows_server_2012 | >= 6.2.9200.0 < 6.2.9200.25868 | 6.2.9200.25868 |
| microsoft | windows_server_2012_r2 | >= 6.3.9600.0 < 6.3.9600.22968 | 6.3.9600.22968 |
| microsoft | windows_server_2016 | < 10.0.14393.8783 | 10.0.14393.8783 |
| microsoft | windows_server_2016 | >= 10.0.14393.0 < 10.0.14393.8783 | 10.0.14393.8783 |
| microsoft | windows_server_2019 | < 10.0.17763.8276 | 10.0.17763.8276 |
| microsoft | windows_server_2019 | >= 10.0.17763.0 < 10.0.17763.8276 | 10.0.17763.8276 |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for crafted RPC requests sent to the Windows Telephony Service from low-privileged domain accounts, particularly requests that result in file write operations on the server. ↗
- →Monitor the Windows Telephony Service process (tapisrv.dll / TAPISRV) for unexpected DLL load events, particularly DLLs loaded from attacker-writable paths, which may indicate exploitation of the malicious DLL loading stage. ↗
- →Scope detection to adjacent/intra-domain network traffic only; exploitation requires the attacker to be in the same restricted Active Directory domain as the target system. ↗
- ·The attack vector is Adjacent (AV:A), meaning exploitation is constrained to attackers already present within the same restricted Active Directory domain; detections should be scoped accordingly and not expected from broader internet-facing sources. ↗
- ·Exploitation requires only a low-privileged domain account, lowering the bar for insider or compromised-credential scenarios; do not rely on privilege-based access controls alone as a compensating control. ↗
- ·Successful exploitation ultimately yields SYSTEM privileges, making this a high-impact privilege escalation; treat any confirmed exploitation as a full system compromise event. ↗
CVSS provenance
nvdv3.18.0HIGHCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vulncheck8.0HIGH
vendor_msrc8.0HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Microsoft
Windows Telephony Service Elevation of Privilege Vulnerability
vendor_msrc·2026-01-13·CVSS 8.0
CVE-2026-20931 [HIGH] CWE-73 Windows Telephony Service Elevation of Privilege Vulnerability
Windows Telephony Service Elevation of Privilege Vulnerability
Description: External control of file name or path in Windows Telephony Service allows an authorized attacker to elevate privileges over an adjacent network.
FAQ: What privileges could be gained by an attacker who successfully exploited this vulnerability?
An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.
FAQ: How could an attacker exploit this vulnerability?
An attacker with a low‑privileged domain account could remotely send crafted RPC requests to the Telephony service, causing it to write attacker‑controlled data into files on the server. By overwriting Telephony’s configuration file, the attacker can make themselves a Telephony administrator and trigger the service to load a malicio
VulDB
Microsoft Windows up to Server 2025 Telephony Service file inclusion
vuldb·2026-05-27·CVSS 8.0
CVE-2026-20931 [HIGH] Microsoft Windows up to Server 2025 Telephony Service file inclusion
A vulnerability, which was classified as critical, was found in Microsoft Windows. Impacted is an unknown function of the component Telephony Service. The manipulation results in file inclusion.
This vulnerability was named CVE-2026-20931. The attack needs to be approached within the local network. There is no available exploit.
A patch should be applied to remediate this issue.
GHSA
GHSA-qvh8-5v9x-29hh: External control of file name or path in Windows Telephony Service allows an authorized attacker to elevate privileges over an adjacent network
ghsa_unreviewed·2026-01-13
CVE-2026-20931 [HIGH] CWE-73 GHSA-qvh8-5v9x-29hh: External control of file name or path in Windows Telephony Service allows an authorized attacker to elevate privileges over an adjacent network
External control of file name or path in Windows Telephony Service allows an authorized attacker to elevate privileges over an adjacent network.
VulnCheck
Microsoft Windows External Control of File Name or Path
vulncheck·2026·CVSS 8.0
CVE-2026-20931 [HIGH] Microsoft Windows External Control of File Name or Path
Microsoft Windows External Control of File Name or Path
External control of file name or path in Windows Telephony Service allows an authorized attacker to elevate privileges over an adjacent network.
Affected: Microsoft Windows
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://www.recordedfuture.com/blog/january-2026-cve-landscape
No detection rules found.
No public exploits indexed.
Qualys
Microsoft and Adobe Patch Tuesday, January 2026 Security Update Review
blogs_qualys·2026-01-13
Microsoft and Adobe Patch Tuesday, January 2026 Security Update Review
## Table of Contents
Microsoft Patch Tuesday forJanuary2026
Adobe Patches for January 2026
Zero-day Vulnerabilities Patched inJanuaryPatch Tuesday Edition
Critical Severity Vulnerabilities Patched inJanuaryPatch Tuesday Edition
Other Microsoft Vulnerability Highlights
Microsoft Release Summary
Discover and Prioritize Vulnerabilities inVulnerability Management, Detection & Response (VMDR)
Rapid Response with TruRisk Eliminate
EVALUATE Vendor-Suggested Mitigation withPolicy Audit(PA)
Qualys Monthly Webinar Series
Starting the year on a security-first note, Microsoft’s January 2026 Patch Tuesday resolves several vulnerabilities that could impact enterprise environments. Here’s a quick breakdown of what you need to know.
## Microsoft Patch Tuesday for January 2026
This month’s rel
Bleepingcomputer
Microsoft January 2026 Patch Tuesday fixes 3 zero-days, 114 flaws
blogs_bleepingcomputer·2026-01-13·CVSS 5.5
[MEDIUM] Microsoft January 2026 Patch Tuesday fixes 3 zero-days, 114 flaws
## Microsoft January 2026 Patch Tuesday fixes 3 zero-days, 114 flaws
## Lawrence Abrams
57 Elevation of Privilege vulnerabilities
3 Security Feature Bypass vulnerabilities
22 Remote Code Execution vulnerabilities
22 Information Disclosure vulnerabilities
2 Denial of Service vulnerabilities
5 Spoofing vulnerabilities
When BleepingComputer reports on Patch Tuesday security updates, we only count those released by Microsoft today. Therefore, the number of flaws does not include Microsoft Edge (1 flaw) and Mariner vulnerabilities fixed earlier this month.
To learn more about the non-security updates released today, you can review our dedicated articles on the Windows 11 KB5074109 & KB5073455 cumulative updates and Windows 10 KB5073724 extended security update .
## 3 zero-days, one ex
Qualys
Microsoft and Adobe Patch Tuesday, January 2026 Security Update Review | Qualys
blogs_qualys·2026-01-13
Microsoft and Adobe Patch Tuesday, January 2026 Security Update Review | Qualys
#### Table of Contents
- Microsoft Patch Tuesday forJanuary2026
- Adobe Patches for January 2026
- Zero-day Vulnerabilities Patched inJanuaryPatch Tuesday Edition
- Critical Severity Vulnerabilities Patched inJanuaryPatch Tuesday Edition
- Other Microsoft Vulnerability Highlights
- Microsoft Release Summary
- Discover and Prioritize Vulnerabilities inVulnerability Management, Detection & Response (VMDR)
- Rapid Response with TruRisk Eliminate
- EVALUATE Vendor-Suggested Mitigation withPolicy Audit(PA)
- Qualys Monthly Webinar Series
Starting the year on a security-first note, Microsoft’s January 2026 Patch Tuesday resolves several vulnerabilities that could impact enterprise environments. Here’s a quick breakdown of what you need to know.
## Microsoft Patch Tuesday for January 2026
Thi
Wiz
CVE-2026-20931 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.0
CVE-2026-20931 [HIGH] CVE-2026-20931 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-20931 :
vulnerability analysis and mitigation
External control of file name or path in Windows Telephony Service allows an authorized attacker to elevate privileges over an adjacent network.
Source : NVD
## 8
Score
Published January 13, 2026
Severity HIGH
CNA Score 8.0
Has Public Exploit Yes
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 73.8
Exploitation Probability (EPSS) 0.8
Sources
NVD
## Get a CVE risk assessment
Get a prioritized view of CVEs in your cloud—so you can focus on what's exploitable, not just what's listed.
Free Vulnerability Assessment
## Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk lev
Recorded Future
January 2026 CVE Landscape: 23 Critical Vulnerabilities Mark 5% Increase, APT28 Exploits Microsoft Office Zero-Day
blogs_recorded_future·CVSS 4.9
[MEDIUM] January 2026 CVE Landscape: 23 Critical Vulnerabilities Mark 5% Increase, APT28 Exploits Microsoft Office Zero-Day
# January 2026 CVE Landscape: 23 Critical Vulnerabilities Mark 5% Increase, APT28 Exploits Microsoft Office Zero-Day
January 2026 saw a modest 5% increase in high-impact vulnerabilities, with Recorded Future's Insikt Group® identifying 23 vulnerabilities requiring immediate remediation, up from 22 in December 2025. Noteworthy trends last month included Russian state-sponsored exploitation of a Microsoft Office zero-day and critical authentication bypass flaws affecting enterprise infrastructure.
What security teams need to know:
- APT28's Operation Neusploit: Russian state-sponsored actors exploited CVE-2026-21509 (Microsoft Office) via weaponized RTF files, delivering MiniDoor, PixyNetLoader, and Covenant Grunt implants
- Microsoft and SmarterTools lead concerns: These vendors accounte
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20931https://www.vicarius.io/vsociety/posts/cve-2026-20931-detection-script-elevation-of-privilege-vulnerability-in-windows-telephony-servicehttps://www.vicarius.io/vsociety/posts/cve-2026-20931-mitigation-script-elevation-of-privilege-vulnerability-in-windows-telephony-service
2026-01-13
Published
Exploited in the wild