Windows FSRM Service: Privilege escalation through untrusted pointer dereference

Summary

The Windows File Server Resource Management Service (FSRM) on Windows Server 2016, 2019, 2022 and 2025 contains an untrusted pointer dereference. An attacker with physical access to a server can elevate privileges without authentication and without user interaction. The CVSS vector (AV:P) means remote exploitation is not possible, so the risk mainly applies to servers in unlocked rooms, branch offices, co-location sites, and to stolen or decommissioned hardware. CVSS 6.8 (Medium).

Affected

• Windows Server 2016 and 2016 Server Core: builds 10.0.14393.0 to before 10.0.14393.9688
• Windows Server 2019 and 2019 Server Core: builds 10.0.17763.0 to before 10.0.17763.9487
• Windows Server 2022: builds 10.0.20348.0 to before 10.0.20348.5870
• Windows Server 2025 and 2025 Server Core: builds 10.0.26100.0 to before 10.0.26100.33822
• Windows client versions: Unknown.

Fixed in

• Windows Server 2016 and Server Core: 10.0.14393.9688 or later
• Windows Server 2019 and Server Core: 10.0.17763.9487 or later
• Windows Server 2022: 10.0.20348.5870 or later (November 10, 2026 cumulative update KB5131090)
• Windows Server 2025 and Server Core: 10.0.26100.33822 or later
• Other KB numbers: verify on the MSRC update guide before deployment.

Workaround

Unknown. No vendor workaround is listed in the sources.

• Restrict physical access to server rooms and cabinets.
• Protect BIOS/UEFI with a password, enable Secure Boot, and restrict USB and boot options.

Exploitation

• Publicly disclosed: No (MSRC).
• Exploit code maturity: Unproven (MSRC temporal vector E:U).
• Public proof of concept: None found.
• Exploited in the wild: Not known to be exploited.
• CISA SSVC: Exploitation none, not automatable.

Our recommendation

• Install the November 2026 cumulative update on all affected Windows Server systems, and verify the build number afterwards.
• Check which servers run the FSRM role and where they are physically located.
• Restrict physical access, lock server rooms, and secure or destroy decommissioned disks and hardware.
• Monitor for unexpected local administrator accounts or privilege changes on file servers.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-108415 msrc.microsoft.com
• CVE.org CVE Record: CVE-2026-108415 www.cve.org
• Microsoft KB5131090: Windows Server 2022 security update (November 2026) support.microsoft.com
• OffSeq threat radar: CVE-2026-108415 radar.offseq.com
• Strix.ai: CVE-2026-108415 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 10:43.