CVE-2026-57988: Microsoft Edge Path Traversal Remote Code Execution Vulnerability

Technical summary

CVE-2026-57988 is a relative path traversal flaw (CWE-23) in Microsoft Edge's Chromium implementation. The vulnerability exists in how the browser resolves relative file paths, enabling an attacker to construct specially crafted paths that escape intended directory boundaries. When a user navigates to a malicious URL or resource, the path traversal condition is triggered, allowing code execution in the network-exposed attack surface. The CVSS v3.1 score of 7.1 (HIGH) reflects a network-based attack vector with low complexity and no required privileges, but does require user interaction. Impact is split between integrity (code execution and system modification) and limited availability (process-level denial of service).

Business impact

This vulnerability poses a moderate-to-high risk to organizations where Edge is a primary browser or where users access untrusted web content. Successful exploitation could lead to credential theft, malware installation, data exfiltration, or lateral movement into internal networks. The user-interaction requirement reduces the immediate attack surface compared to wormable flaws, but phishing campaigns and malicious advertising can reliably trigger exploitation. Organizations relying on Edge for line-of-business applications or sensitive workflows should prioritize patching to avoid business disruption and potential compliance violations.

Affected systems

The vulnerability affects all versions of Microsoft Edge based on Chromium prior to the patched release. Organizations should verify the specific affected versions in the official Microsoft security advisory. Both consumer and enterprise deployments of Edge are at risk. Systems running older, unpatched versions should be considered vulnerable, with higher risk for machines that frequently access external or untrusted websites.

Exploitability

The vulnerability is exploitable but not trivial. An attacker must host a malicious resource or compromise a website visited by the target user. The relative path traversal condition must be met through crafted input, and the user must navigate to the attacker-controlled content. While not zero-click, this is a plausible attack chain against users of compromised websites, phishing emails with malicious links, or drive-by download scenarios. The lack of KEV status indicates active exploitation has not been confirmed in the wild at the time of publication, but this should not be interpreted as low risk—path traversal flaws are well-understood and historically attractive to attackers.

Remediation

Apply the latest security update for Microsoft Edge as soon as practical. Microsoft typically releases patches through automatic updates; verify that Edge is running the latest version via Help > About Microsoft Edge. For enterprise environments, deploy patches through Windows Update or Microsoft Intune to ensure consistent coverage. Disable Edge if it is not essential, or enforce browsing policies that restrict access to high-risk sites. Consider running Edge in a sandbox or using Windows Sandbox for untrusted content.

Patch guidance

Verify the latest patched version of Microsoft Edge in the official Microsoft Security Update Guide and edge release notes. Apply updates immediately upon availability; most users will receive patches automatically, but manually check Settings > About to confirm the update has been installed. Enterprise administrators should validate patch deployment through their management tools (Intune, Group Policy, or third-party mobile device management) and confirm all user devices are on a patched build before considering the risk mitigated.

Detection guidance

Monitor for suspicious Edge process behavior, including unexpected file access outside normal user directories, unusual network connections from Edge, or process spawning. Inspect web server logs and proxy logs for requests to maliciously crafted relative paths that might signal exploitation attempts. Endpoint detection and response (EDR) tools should flag code execution originating from Edge with unexpected parent-child process chains. Web proxy and DNS telemetry can help identify users accessing known malicious hosts. However, detection is challenging for targeted attacks; prevention through patching remains the most reliable control.

Why prioritize this

This vulnerability merits high-priority remediation due to its network-attack vector, ease of exploitation in real-world phishing scenarios, and potential for code execution. Although user interaction is required, the interaction bar is low (clicking a link). The lack of weaponization in KEV does not diminish the inherent risk—relative path traversal is a classic, well-understood attack pattern. Organizations with high user populations, active threat intelligence indicating path-traversal attacks, or business-critical workflows in Edge should patch within 48–72 hours. Standard endpoints without critical Edge dependencies should follow a standard patch cycle (within 1–2 weeks).

Risk score, explained

The CVSS v3.1 score of 7.1 (HIGH) is driven by a network attack vector (AV:N), low attack complexity (AC:L), and no privilege or user-interaction requirements beyond navigation (UI:R). The impact on integrity is high (code execution), and availability impact is low (process-level DoS). The score does not account for real-world exploit availability or active attacks; however, the user-interaction component prevents a CRITICAL rating. Organizations should treat this as a high-severity vulnerability requiring urgent patching, even without CVSS exceeding 8.0.

Frequently asked questions