First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-72971

MediumCVSS 5.5/10Last modified Oct 24, 2026

Description

Improper link resolution before file access ('link following') in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to perform tampering locally.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
Microsoft	Windows 11 version 26H1	>= 10.0.28000.0, < 10.0.28000.2704

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-72971Vendor Advisory, Patch

Timeline

Published: Aug 11, 2026
Last modified: Oct 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-729728.8Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.CVE-2026-729738.8Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.CVE-2026-729746.5Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.CVE-2026-729756.5Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.CVE-2026-729765.0Out-of-bounds read in Microsoft Office Word allows an authorized attacker to disclose information locally.CVE-2026-729776.5Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.CVE-2026-729787.5Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny CVE-2026-729799.8Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network.CVE-2026-72986.1Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in IdeaSoft Software Industry and Trade I CVE-2026-729805.5Uncontrolled search path element in Windows Hello allows an authorized attacker to bypass a security feature locally.CVE-2026-729818.1Use after free in IP Helper allows an unauthorized attacker to execute code over a network.CVE-2026-729829.8Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over a network.

CVE-2026-72971: Medium severity, CVSS 5.5 | Vulnix