Microsoft Windows WMI: Weak authentication allows local privilege escalation

Summary

Weak authentication in Windows Management Instrumentation (WMI) lets an authorized local user elevate their privileges. According to Microsoft, successful exploitation can give the attacker unauthorized access to protected Windows management namespaces. The attacker needs a valid low-privilege account on the affected machine, so the risk is mainly a second stage after a phishing, malware or stolen-credential foothold.

Affected

• Windows 10 Version 1607, 1809, 21H2 and 22H2
• Windows 11 Version 23H2, 24H2, 25H2 and 26H2, and Version 26H1
• Windows Server 2016 (including Server Core), 2019 (including Server Core) and 2022
• Affected builds are those below the build numbers listed in the CVE record (for example 10.0.19045.7846 for Windows 10 22H2 and 10.0.26100.9974 for Windows 11 24H2)
• Windows Server 2025 and other builds: Unknown (not in the official CVE record; a third-party source lists it, unverified)

Fixed in

• Fixed in the November 2026 security update (Patch Tuesday, November 10, 2026)
• Fixed builds per the CVE record: 10.0.14393.9688 (Server 2016 / Windows 10 1607), 10.0.17763.9487 (Server 2019 / Windows 10 1809), 10.0.19044.7846 (21H2), 10.0.19045.7846 (22H2), 10.0.22631.7711 (23H2), 10.0.26100.9974 (24H2), 10.0.26200.9974 (25H2), 10.0.26300.9974 (26H2), 10.0.28000.3501 (26H1), 10.0.20348.5870 (Server 2022)
• KB numbers: Unknown. Verify the exact fixed builds in the MSRC product table.

Workaround

Unknown. No vendor-documented workaround was found. Installing the update is the mitigation.

Exploitation

• No evidence of exploitation in the wild was found.
• CISA SSVC: exploitation none, not automatable, total technical impact.
• Tenable lists Microsoft's exploitability assessment as 'Exploitation More Likely', which is a forecast, not a confirmed attack.
• Public proof of concept: Unknown (none found, not confirmed absent).
• Not confirmed to be in the CISA KEV catalogue (unverified).

Our recommendation

• Install the November 2026 cumulative update on all affected Windows 10, 11 and Server systems via Windows Update, WSUS or Intune.
• Prioritise servers, terminal servers, RDP hosts and shared multi-user systems.
• Check the MSRC product table for the exact fixed builds of each system.
• Review local accounts and restrict unnecessary local logons.
• Recheck the exploitation status after one to two weeks.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-105524 msrc.microsoft.com
• Microsoft Security Update Guide (en-US) msrc.microsoft.com
• CVE.org record CVE-2026-105524 www.cve.org
• Tenable: Microsoft November 2026 Patch Tuesday www.tenable.com
• Strix: CVE-2026-105524 (third-party, verify) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 04:35.