Microsoft Windows Storage: Elevation of privilege due to weak authentication

Summary

A weakness in the Windows Storage component allows an authorized local attacker to elevate privileges on the affected system. The attacker needs a valid logon on the machine and must reproduce the attack under high complexity conditions. Successful exploitation could lead to high impact on confidentiality, integrity and availability.

Affected

• Windows 10 Version 1607, 1809, 21H2 and 22H2 (older builds below the fixed versions)
• Windows 11 Version 23H2, 24H2, 25H2, 26H1 and 26H2 (builds below the fixed versions)
• Windows Server 2016, 2019 and 2022 (including Server Core installations)
• Exact affected build ranges per product are listed in the CVE record; Windows 10 22H2 range is incomplete in the retrieved source

Fixed in

• Windows 10 1607: 10.0.14393.9688
• Windows 10 1809: 10.0.17763.9487
• Windows 10 21H2: 10.0.19044.7846
• Windows 10 22H2: 10.0.19045.7846
• Windows 11 23H2: 10.0.22631.7711
• Windows 11 24H2: 10.0.26100.9974
• Windows 11 25H2: 10.0.26200.9974
• Windows 11 26H1: 10.0.28000.3501
• Windows 11 26H2: 10.0.26300.9974
• Windows Server 2016: 10.0.14393.9688
• Windows Server 2019: 10.0.17763.9487
• Windows Server 2022: 10.0.20348.5870
• Confirm the KB numbers in the MSRC advisory; the fix status of the Windows Server 2022 update KB5131090 is not yet verified

Workaround

Unknown.

Exploitation

• Microsoft's CISA SSVC assessment lists exploitation as none and automatable as no.
• The CVSS temporal vector indicates exploit code maturity 'unproven'.
• No public proof of concept or known exploitation was found at the time of writing.
• NVD analysis is still pending.

Our recommendation

• Confirm the exact fixed build for each product in the MSRC advisory.
• Install the current Windows security updates on all affected hosts and verify the patch status.
• Prioritise multi-user systems, terminal servers and servers where local users are present.
• Check whether older Windows 10 builds are still under support or ESU coverage, and plan upgrades for unpatchable systems.
• Re-check the MSRC advisory and NVD entry in the coming days.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-105529 msrc.microsoft.com
• CVE.org CVE Record CVE-2026-105529 www.cve.org
• strix.ai CVE-2026-105529 www.strix.ai
• Senserva KB5131090 (unverified) senserva.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 09:42.