CVE-2026-57088 windows 10 1809 vulnerability

Who is affected

How to fix it

CVE-2026-57088 is an improper-access-control flaw in the Extensible Storage Engine (ESENT) that can let a locally authenticated, low-privilege attacker elevate privileges. Install KB5099538, or a later superseding cumulative update, restart the system, and verify Microsoft Windows 10 Version 1809 is on OS build 10.0.17763.9020 or later. Prioritize shared and multi-user systems, remote-desktop hosts, and endpoints exposed to untrusted local accounts.

1. Identify the asset owner, maintenance window, exposure, and business role for every affected Microsoft Windows 10 Version 1809 system.
2. Inventory affected Windows endpoints and servers, then identify every Microsoft Windows 10 Version 1809 system below OS build 10.0.17763.9020.
3. Install KB5099538, or a later superseding cumulative update, restart the system, and verify Microsoft Windows 10 Version 1809 is on OS build 10.0.17763.9020 or later.
4. Microsoft lists no workaround. As defense in depth before patching, enforce least privilege and restrict local access to systems and applications that use ESENT databases.
5. Review ESENT errors, local logons, process creation, privilege changes, and EDR alerts.
6. If exploitation is suspected, isolate the system, preserve evidence, remove persistence, restore or rebuild from a known-good source, and rotate affected credentials.
7. Confirm the required Windows restart completed, security tools are healthy, and temporary controls remain until the fleet is fully compliant.

Verify the fix

• Confirm Microsoft Windows 10 Version 1809 reports OS build 10.0.17763.9020 or later, KB5099538 or a superseding cumulative update is installed, and the last boot time is after installation.
• Confirm the patched component passes a safe vendor-approved regression or vulnerability scan without the previous finding.
• Confirm local-logon rights, untrusted-file handling, exposed Windows services and protocols, and host firewall rules match the system's approved security baseline.
• Review logs after remediation for continued exploit attempts or signs that the issue was used before the fix.
• Rerun the relevant dependency, platform, vendor, or Fixnx security check and document the result, affected assets, change record, and cleanup evidence for CVE-2026-57088.

Related categories

Related security risks

More published guidance from the same primary category.

Trusted references

FAQ