Microsoft Windows Network Connection Broker: Local privilege escalation

Summary

A flaw in the Windows Network Connection Broker component allows an authorized local user to elevate privileges. Microsoft's record reports an integer overflow or wraparound, while CWE-416 (use-after-free) is also listed, so the root cause is not yet clarified. An attacker needs local access with low privileges and a high-complexity condition, and the impact is total on the affected system. Exploitation is not known and no public proof of concept was found.

Affected

• Windows 10 Version 1607 and Windows Server 2016 (including Server Core): 10.0.14393.0 to before 10.0.14393.9688
• Windows 10 Version 1809 and Windows Server 2019 (including Server Core): 10.0.17763.0 to before 10.0.17763.9487
• Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7846
• Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7846
• Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7711
• Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9974
• Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9974
• Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3501
• Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9974
• Windows Server 2022: 10.0.20348.0 to before 10.0.20348.5870
• Windows Server 2025: Unknown, verify in MSRC.

Fixed in

• Install the Windows security update from November 2026 that brings the build to the fixed version listed for your edition (for example 10.0.19045.7846 for Windows 10 22H2, 10.0.22631.7711 for Windows 11 23H2, 10.0.20348.5870 for Windows Server 2022).
• Windows Server 2025: Unknown, verify in MSRC.
• Confirm the exact KB number for each operating system in the MSRC Security Update Guide.

Workaround

Unknown.

• No Microsoft workaround was found in the sources reviewed.

Exploitation

• Microsoft's exploit maturity section lists Exploited: No.
• CISA SSVC assessment: Exploitation none, Automatable no, Technical Impact total.
• No public proof of concept was found in the searches performed; this does not prove that none exists.
• CISA KEV status was not verified directly.

Our recommendation

• Install the November 2026 Windows security update on all affected Windows hosts in the normal patch cycle.
• Prioritize terminal servers, file servers and shared workstations.
• Upgrade any remaining Windows 10 1607 or 1809 systems, as these builds are out of support.
• Limit local logon rights and reduce local administrator rights until patching is complete.
• Monitor for privilege escalation alerts and re-check the MSRC page and CISA KEV catalogue in one to two weeks.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-105525 msrc.microsoft.com
• CVE Record: CVE-2026-105525 www.cve.org
• Strix: CVE-2026-105525 www.strix.ai
• Senserva KB5131090 (November 2026 update, third-party) senserva.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 10:31.